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Abstract 


This document defines a deterministic digital signature generation 
procedure. Such signatures are compatible with standard Digital 
Signature Algorithm (DSA) and Elliptic Curve Digital Signature 
Algorithm (ECDSA) digital signatures and can be processed with 
unmodified verifiers, which need not be aware of the procedure 
described therein. Deterministic signatures retain the cryptographic 
security features associated with digital signatures but can be more 
easily implemented in various environments, since they do not need 
access to a source of high-quality randomness. 
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1. Introduction 


DSA [FIPS-186-4] and ECDSA [X9.62] are two standard digital signature 
schemes. They provide data integrity and verifiable authenticity in 
various protocols. 


One characteristic of DSA and ECDSA is that they need to produce, for 
each signature generation, a fresh random value (hereafter designated 
as k). For effective security, k must be chosen randomly and 
uniformly from a set of modular integers, using a cryptographically 
secure process. Even slight biases in that process may be turned 
into attacks on the signature schemes. 


The need for a cryptographically secure source of randomness proves 
to be a hindrance to deployment of DSA and ECDSA signature schemes in 
some architectures in which secure random number generation is 
challenging, in particular, embedded systems such as smartcards. In 
those systems, the RSA signature algorithm, used as specified in 
Public-Key Cryptography Standards (PKCS) #1 [RFC3447] (with "type 1" 
padding, not the Probabilistic Signature Scheme (PSS)) and ISO 9796-2 
[ISO-9796-2], is often preferred, even though it is computationally 
more expensive, because RSA (with such padding schemes) is 
deterministic and thus does not require a source of randomness. 


The randomized nature of DSA and ECDSA also makes implementations 
harder to test. Automatic tests cannot reliably detect whether the 
implementation uses a source of randomness of high enough quality. 
This makes the implementation process more vulnerable to catastrophic 
failures, often discovered after the system has been deployed and 
successfully attacked. 


It is possible to turn DSA and ECDSA into deterministic schemes by 
using a deterministic process for generating the "random" value k. 
That process must fulfill some cryptographic characteristics in order 
to maintain the properties of verifiability and unforgeability 
expected from signature schemes; namely, for whoever does not know 
the signature private key, the mapping from input messages to the 
corresponding k values must be computationally indistinguishable from 
what a randomly and uniformly chosen function (from the set of 
messages to the set of possible k values) would return. 
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This document describes such a procedure. It has the following 
features: 


o Produced signatures remain fully compatible with plain DSA and 
ECDSA. Entities that verify the signatures need not be changed or 
even be aware of the process used to generate k. 


o Key pair generation is not altered. Existing private keys can be 
used with deterministic DSA and ECDSA. 


o Using deterministic DSA and ECDSA implies no extra storage 
requirement of any secret or public value. 


o Deterministic DSA and ECDSA can be applied over the same inputs as 
plain DSA and ECDSA, namely a hash value computed over the message 
that is to be signed, with a cryptographically secure hash 
function. 


Some relatively arbitrary choices were taken in the definition of 
deterministic (EC)DSA as specified in this document; this was done in 
order to make it as universally applicable as possible, so as to 
maximize usefulness of included test vectors. See Section 3.6 fora 
discussion of some possible variants. 


It shall be noted that key pair generation still requires a source of 
randomness. In embedded systems where quality of randomness is an 
issue, it can often be arranged that key pair generation occurs 
within more controlled conditions (e.g., during a special smartcard 
initialization procedure or under physical control of sworn agents) 
or the key might even be generated elsewhere and imported in the 
device. Deterministic DSA and ECDSA only deal with the need for 
randomness at the time of signature generation. 


1.1. Requirements Language 
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 


"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 
document are to be interpreted as described in RFC 2119 [RFC2119]. 


2. DSA and ECDSA Notations 
In this section, we succinctly describe DSA and ECDSA and define our 


notations. The complete specifications for DSA and ECDSA can be 
found in [FIPS-186-4] and [X9.62], respectively. 
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2.1. Key Parameters 


DSA and ECDSA work over a large group of prime size, in which the 
group operation is easy to compute, but the discrete logarithm is 
computationally infeasible with existing and foreseeable technology. 
The definition of the group is called the "key parameters". Key 
parameters may be shared between different key pairs with no ill 
effect on security; this is the usual case with ECDSA in particular. 


DSA uses the following key parameters: 
p a large prime number (at least 1024 bits) 


q a sufficiently large prime number (at least 160 bits) that is 
also a divisor of p-1 


g a generator for the multiplicative subgroup of order q of 
integers modulo p 


The group on which DSA will be computed consists of the values 
'g*j mod p’, where ’*%’ denotes exponentiation and j ranges from 0 to 
a-1 (inclusive). The size of the group is q. 


ECDSA uses the following key parameters: 
E an elliptic curve, defined over a given finite field 


q a sufficiently large prime number (at least 160 bits) that is a 
divisor of the curve order 


G a point of E, of order q 


The group on which ECDSA will be computed consists of the curve 
points jG (multiplication of point G by integer j) where j ranges 
from 0 to q-1. G is such that qG = 0 (the "point at infinity" on the 
curve E). The size of the group is q. Note that these notations 
slightly differ from those described in [X9.62]; we use them in order 
to match those used for DSA. 


2.2. Key Pairs 
A DSA or ECDSA private key is an integer x taken modulo q. The 


relevant standards prescribe that x shall not be 0; hence, x is an 
integer in the range [1, q-1]. 
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A DSA or ECDSA public key is computed from the private key x and the 
key parameters: 


o For DSA, the public key is the integer: y = g*x mod p 
o For ECDSA, the public key is the curve point: U = xG 
2.3. Integer Conversions 


Let qlen be the binary length of q. qlen is the smallest integer 
such that q is less than 2%qlen. This is the size of the binary 
representation of q without a sign bit (note that q, being a big 
prime, is odd, thus avoiding any ambiguity about the length of any 
integer equal to a power of 2). We define five conversion functions, 
which work on strings of bits, octets, and integers modulo q. qlen 
is the main parameter for these conversions. 


In the following subsections, we use two other lengths, called blen 
and rlen. rlen is equal to qlen, rounded up to the next multiple of 
8 (if qlen is already a multiple of 8, then rlen equals qlen; 
otherwise, rlen is slightly larger, up to glen+7). Note that rlen is 
unrelated to the value r, the first half of a generated signature. 
blen is the length (in bits) of an input sequence of bits and may 
vary between calls. blen may be smaller than, equal to, or larger 
than qlen. 


2.3.1. Bits and Octets 


Formally, all operations are defined on sequences of bits. A 
sequence is ordered; the first bit is said to be leftmost, while the 
last bit is rightmost. 


On most software systems, bits are grouped into octets (sequences of 
eight bits). Binary data, e.g., the output of a hash function, is 
available as a sequence of octets. Whenever applicable, we consider 
that bits within an octet are ordered from most significant to least 
significant: the first (leftmost) bit within an octet has numerical 
value 128, while the last (rightmost) has numerical value 1. 


2.3.2. Bit String to Integer 
The bits2int transform takes as input a sequence of blen bits and 


outputs a non-negative integer that is less than 2*%qlen. It consists 
of the following steps: 
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1. The sequence is first truncated or expanded to length qlen: 


* if qlen < blen, then the glen leftmost bits are kept, and 
subsequent bits are discarded; 


* otherwise, qlen-blen bits (of value zero) are added to the 
left of the sequence (i.e., before the input bits in the 
sequence order). 


2. The resulting sequence is then converted to an integer value 
using the big-endian convention: if input bits are called b_0 
(leftmost) to b_(qlen-1) (rightmost), then the resulting value 
is: 


b_0*2” (qlen-1) + b_1*2” (glen-2) + ... + b_(qlen-1) *2%0 


The bits2int transform can also be described in the following way: 
the input bit sequence (of length blen) is transformed into an 
integer using the big-endian convention. Then, if blen is greater 
than qlen, the resulting integer is divided by two to the power 
blen-qlen (Euclidian division: the remainder is discarded); in many 
software implementations of arithmetics on big integers, that 
division is equivalent to a "right shift" by blen-qlen bits. 


2.3.3. Integer to Octet String 


An integer value x less than q (and, in particular, a value that has 
been taken modulo q) can be converted into a sequence of rlen bits, 
where rlen = 8*ceil(qlen/8). This is the sequence of bits obtained 
by big-endian encoding. In other words, the sequence bits x_i (for i 
ranging from 0 to rlen-1) are such that: 


x = x_0*2%(rlen-1) + x_1*2” (rlen-2) + ... + x_(rlen-1) 


We call this transform int2octets. Since rlen is a multiple of 8 
(the smallest multiple of 8 that is not smaller than qlen), then the 
resulting sequence of bits is also a sequence of octets, hence the 
name. 


2.3.4. Bit String to Octet String 


The bits2octets transform takes as input a sequence of blen bits and 
outputs a sequence of rlen bits. It consists of the following steps: 


1. The input sequence b is converted into an integer value zl 
through the bits2int transform: 


zl = bits2int (b) 
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2. zl is reduced modulo q, yielding z2 (an integer between 0 and 
a-1, inclusive): 


z2 = z1 mod q 


Note that since zl is less than 2^qlen, that modular reduction 
can be implemented with a simple conditional subtraction: 
z2 = zl-q if that value is non-negative; otherwise, z2 = z1. 


3. z2 is transformed into a sequence of octets (a sequence of rlen 
bits) by applying int2octets. 


3.5. Usage 


It is worth noting that int2octets is not the reverse of bits2int, 
even for input sequences of length qlen: int2octets will add some 
bits on the left, while bits2int will discard some bits on the right. 
int2octets is the reverse of bits2int only when qlen is a multiple of 
8 and bit sequences already have length qlen. 


bits2int is used during signature generation and verification in 
standard DSA and ECDSA to transform a hash value (computed over the 
input message) into an integer modulo q. That is, the integer 
obtained through bits2int is further reduced modulo q; since that 
integer is less than 2*%qlen, that reduction can be performed with at 
most one subtraction. 


int2octets is defined under the name "Integer-to-OctetString" in 
Section 2.3.7 of SEC 1 [SEC1]. It is used in the specification of 
the encoding of an ECDSA private key (x) within an ASN.1-based 
structure. 


bits2octets is not used in standard DSA or ECDSA. We will use it in 
the specification of deterministic (EC)DSA. 


4. Signature Generation 


Signature generation uses a cryptographic hash function H and an 
input message m. The message is first processed by H, yielding the 
value H(m), which is a sequence of bits of length hlen. Normally, H 
is chosen such that its output length hlen is roughly equal to qlen, 
since the overall security of the signature scheme will depend on the 
smallest of hlen and qlen; however, the relevant standards support 
all combinations of hlen and qlen. 
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The following steps are then applied: 


1. H(m) is transformed into an integer modulo q using the bits2int 
transform and an extra modular reduction: 


h = bits2int(H(m)) mod q 


As was noted in the description of bits2octets, the extra modular 
reduction is no more than a conditional subtraction. 


2. A random value modulo q, dubbed k, is generated. That value 
shall not be 0; hence, it lies in the [1, q-1] range. Most of 
the remainder of this document will revolve around the process 
used to generate k. In plain DSA or ECDSA, k should be selected 
through a random selection that chooses a value among the q-1 
possible values with uniform probability. 


3. A value r (modulo q) is computed from k and the key parameters: 
* For DSA: 
r = g*k mod p mod q 


(The exponentiation is performed modulo p, yielding a number 
between 0 and p-1, which is then further reduced modulo q.) 


* For ECDSA: the point kG is computed; its X coordinate (a 
member of the field over which E is defined) is converted to 


an integer, which is reduced modulo q, yielding r. 


If r turns out to be zero, a new k should be selected and r 
computed again (this is an utterly improbable occurrence). 


4. The value s (modulo q) is computed: 
s = (h+x*r)/k mod q 
The pair (r, s) is the signature. How a signature is to be 
encoded is not covered by the DSA and ECDSA standards themselves; 


a common way is to use a DER-encoded ASN.1 structure (a SEQUENCE 
of two INTEGERs, for r and s, in that order). 
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3; 


3 


Deterministic DSA and ECDSA 


Deterministic (EC)DSA is the process of generating an (EC)DSA 
signature over an input message m by using the standard (EC)DSA 
signature generation process (discussed in the previous section), 
except that the value k, instead of being randomly generated, is 
obtained through the process described in this section. 


We use the notations described in Section 2. 


.1. Building Blocks 


.1.1. HMAC 


HMAC [RFC2104] is a construction of a Message Authentication Code 
using a hash function and a secret key. Here, we use HMAC with the 
same hash function H as the one used to process the input message 
prior to signature generation or verification. 


We denote the process of applying HMAC with key K over data V by: 


HMAC_K (V) 


which returns a sequence of bits of length hlen (the output length of 
the underlying hash function H). 


.2. Generation of k 


Given the input message m, the following process is applied: 


a. Process m through the hash function H, yielding: 


(hl is a sequence of hlen bits). 
b. Set: 
V = 0x01 0x01 0x01 ... 0x01 


such that the length of V, in bits, is equal to 8*ceil (hlen/8). 
For instance, on an octet-based system, if H is SHA-256, then V 
is set to a sequence of 32 octets of value 1. Note that in this 
step and all subsequent steps, we use the same H function as the 
one used in step ’a’ to process the input message; this choice 
will be discussed in more detail in Section 3.6. 
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Pornin 


K = 0x00 0x00 0x00 ... 0x00 
such that the length of K, in bits, is equal to 8*ceil(hlen/8). 
Set: 

K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets (hl) ) 


where '||' denotes concatenation. In other words, we compute 
HMAC with key K, over the concatenation of the following, in 
order: the current value of V, a sequence of eight bits of value 
0, the encoding of the (EC)DSA private key x, and the hashed 
message (possibly truncated and extended as specified by the 
bits2octets transform). The HMAC result is the new value of K. 
Note that the private key x is in the [1, q-1] range, hence a 
proper input for int2octets, yielding rlen bits of output, i.e., 
an integral number of octets (rlen is a multiple of 8). 


Set: 


V = HMAC_K(V) 


A 
ll 


HMAC_K(V || 0x01 || int2octets(x) || bits2octets(h1)) 


Note that the "internal octet" is 0x01 this time. 


V = HMAC_K(V) 


Apply the following algorithm until a proper value is found for 
k: 


1. Set T to the empty sequence. The length of T (in bits) is 
denoted tlen; thus, at that point, tlen = 0. 


2. While tlen < qlen, do the following: 


V 


HMAC_K (V) 


Te Soe |) | y 
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3. Compute: 
k = bits2int (T) 


If that value of k is within the [1,q-1] range, and is 
suitable for DSA or ECDSA (i.e., it results in an r value 
that is not 0; see Section 3.4), then the generation of k is 
finished. The obtained value of k is used in DSA or ECDSA. 
Otherwise, compute: 


K 


HMAC_K(vV || 0x00) 


V 


HMAC_K(V) 
and loop (try to generate a new T, and so on). 


Please note that when k is generated from T, the result of bits2int 

is compared to q, not reduced modulo q. If the value is not between 
1 and q-1, the process loops. Performing a simple modular reduction 
would induce biases that would be detrimental to signature security. 


3.3. Alternate Description of the Generation of k 


The process described in the previous section is actually derived 
from the "HMAC_DRBG" pseudorandom number generator, described in 
[SP800-90A] and Annex D of [X9.62]. Using the terminology from 
[SP800-90A], the generation of k can be described as such: 


a. Instantiate HMAC_DRBG using HMAC parameterized with the same hash 
function H as the one used for processing the message that is to 
be signed. Instantiation parameters are: 


requested_instantiation_security_strength 
Set this parameter to any value that the HMAC_DRBG 
implementation will accept, when using H as base hash 
function. 


prediction_resistance_flag 
Set this parameter to "false". 


personalization_string 
Set this parameter to "Null" (the empty bit sequence). 


entropy_input 
Use int2octets(x) as entropy string. 


nonce 
Use bits2octets(H(m)) as nonce. 
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Note that the last two parameters are not parameters to the 
HMAC_DRBG instantiation function per se; instead, those values 
are requested from the internal Get_entropy_input function during 
instantiation. For deterministic (EC)DSA, we want HMAC _DRBG to 
run with the entropy string and nonce that we specify, without 
accessing an actual entropy source. 


b. Generate a candidate value for k by requesting qlen bits from 
HMAC_DRBG and converting the resulting bits into an integer with 
the bits2int transform. Repeat this step until a value is 
obtained, which is non-zero, less than q, and suitable for 
(EC)DSA (see Section 3.4). 


Note that we instantiate a new HMAC_DRBG instance for each signature 
generation process. There is no "personalization string" and no 
"additional input" when generating bits. The reseed function of 
HMAC_DRBG is never invoked, neither externally nor as a consequence 
of the internal HMAC_DRBG processing. 


As shown above, we use the encoding of the private key as "entropy 
string" and the hashed message (truncated and expanded by 
bits2octets) as "nonce". In HMAC_DRBG, the entropy string and nonce 
are simply concatenated into the initial seed; hence, the split 
between "entropy" and "nonce" is quite arbitrary. Using qlen bits 
for each ought to be compatible with most HMAC_DRBG implementation 
input requirements. 


3.4. Usage Notes 


With DSA or ECDSA, the value k is used to compute the first half of 


the signature, dubbed r (see Section 2.4). The DSA and ECDSA 
standards mandate that, if r is zero, then a new k should be 
selected. In that situation, this document specifies that the value 


k is "unsuitable", and the generation process shall keep on looping. 


This occurrence is utterly improbable. Actually, it would require 
considerable computational effort (similar to breaking preimage 
resistance of the hash function) to find a private key and a message 
that lead to a zero value for r; hitting such a case by pure chance 
is thus deemed implausible, and an attacker cannot force it with 
carefully crafted messages. In practice, such a code path will not 
be triggered and thus can be implemented with little optimization. 


3.5. Rationale 
The process described in the previous sections mimics the "Approved" 


generation process of k described in Annex D of [X9.62], with the 
"HMAC _DRBG" pseudorandom number generator. The main difference is 
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that we use the concatenation of the private key x and the hashed 
message H(m) as the pseudorandom number generator (PRNG) seed. If 
using a "Security level" of n bits, then HMAC_DRBG should be used 
with seed entropy at least n+64 bits; however, the key x should also 
have been generated with that much entropy, and the length of x is 
qlen, which is at least equal to 2*n and thus larger than n+64 (DSA 
and ECDSA, as specified by the standards, require qlen >= 160). It 
can then be argued that deterministic ECDSA fulfills the entropy 
requirements of Annex D of [X9.62]. 


We use bits2octets(H(m)) instead of H(m) in order to ease 


integration. Indeed, many existing signature systems offload the 
message hashing; the signature engine (which has access to the 
private key) receives only H(m). In some applications, where data 


bandwidth is constrained, only the first qlen bits of H(m) are 
transferred to the signature engine, on the basis that the bits2int 
transform will ignore subsequent bits anyway. Possibly, in some 
systems, the truncated H(m) could be externally reduced modulo q, 
since that is the first thing that (EC)DSA performs on the hashed 
message. With the definition of bits2octets, deterministic (EC)DSA 
can be applied with the same input. 


3.6. Variants 


Many parts of the specification of deterministic (EC)DSA are quite 


arbitrary. It is possible to define variants that are NOT 
"deterministic (EC)DSA" but that may nonetheless be useful in some 
contexts: 


o It is possible to use H(m) directly, instead of bits2octets(H(m)), 
as part of the HMAC input. As explained in Section 3.5, we use 
bits2octets(H(m)) in order to ease integration into systems that 
already use an (EC)DSA signature engine by sending it an already- 
truncated hash value. Using the whole H(m) does not introduce any 
vulnerability. 


o Additional data may be added to the input of HMAC, concatenated 
after bits2octets(H(m)): 


K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k’) 


A use case may be a protocol that requires a non-deterministic 
signature algorithm on a system that does not have access to a 
high-quality random source. It suffices that the additional data 
k’ is non-repeating (e.g., a signature counter or a monotonic 
clock) to ensure "random-looking" signatures are 
indistinguishable, in a cryptographic way, from plain (EC)DSA 
signatures. In [SP800-90A] terminology, k’ is the "additional 
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input" that can be set as a parameter when generating pseudorandom 
bits. This variant can be thought of as a "strengthening" of the 
randomness of the source of the additional data k’. 


o Instead of using x (the private key) as input to HMAC, it is 
possible to use additional secret data, stored along with the 


private key with the same security measures. The entropy of that 
additional data SHALL be at least n bits, preferably n+64 bits or 
more, where n is the target security level. Having additional 


secret data may help in formally proving the security of 
derandomization, but it implies an extra storage cost and 
incompatibility with already-generated (EC)DSA private keys. 


o Similarly, the private key could be a value z, from which both x 
(the "private key" in the plain (EC)DSA sense) and another value 
x’, to be used as input to HMAC in the generation of k, would be 
derived through a suitable Pseudorandom Function (PRF) (such as 
HMAC_DRBG). This would keep private key storage requirements to a 
minimum while providing a more easily proven security, but it 
would impact private key generation and would not be compatible 
with already-generated key pairs. 


o In this document, we use the same hash function H for processing 
the input message and as a parameter to HMAC. Two distinct hash 
functions could be used, provided that both are adequately secure. 
The overall security will be limited by the weaker of the two hash 
functions, i.e., the one with the smaller output. Using a 
specific, constant hash function for HMAC may be useful for 
constrained implementations that accept externally hashed 
messages, regardless of what hash function was used for that, but 
have resources for implementing only one hash function for HMAC. 


The main disadvantage of any variant is that it ceases to be 
verifiable against the test vectors published in this document. 


4. Security Considerations 


Proper implementation and usage of a cryptographic signature 
algorithm require taking into account many parameters. In 
particular, private key generation, storage, access control, and 
disposal are sensitive operations, which this document does not 
address in any way. Deterministic (EC)DSA shows how to achieve the 
security characteristics of a standard DSA or ECDSA signature scheme 
while removing the need for a source of strong randomness, or even 
any source of randomness, during signature generation. 
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Private key generation, however, absolutely requires such a strongly 
random source. In situations where deterministic (EC)DSA is to be 
used due to the lack of an appropriate source of randomness, one must 
assume that the private key has been generated externally and 
imported into the signature generation system or was generated ina 
context where randomness was available. For instance, one can 
imagine a smartcard that generates its private key while still in the 
factory under controlled environmental conditions, but for which 
random data generation cannot be guaranteed once deployed in the 
field, when physically in the hands of potential attackers. 


Both removal of the random source requirement and the ability to test 
an implementation against test vectors enhance security of DSA and 
ECDSA signer implementations, in that they help avoid hard-to-test 
failure conditions. Deterministic signature schemes may also help in 
other situations, e.g., to avoid spurious duplicates, when the same 
data element is signed several times with the same key: with a 
deterministic signature scheme, the same signature is generated every 
time, making duplicate detection much easier. 


Conversely, lack of randomization may have adverse effects in some 
advanced protocols, e.g., related to anonymity in some voting 
schemes. As a rule of thumb, deterministic DSA or ECDSA can be used 
in lieu of the genuine DSA or ECDSA, with no additional security 
issues, if the overall protocol would tolerate another deterministic 
signature scheme, in particular RSA as specified in PKCS #1 [RFC3447] 
(with "type 1" padding, not PSS) or ISO 9796-2 [ISO-9796-2]. The 
list of protocols in which deterministic DSA or ECDSA is appropriate 
includes Transport Layer Security (TLS) [RFC5246], the Secure SHell 
(SSH) Protocol [RFC4251], Cryptographic Message Syntax (CMS) 
[RFC5652] and derivatives, X.509 public key infrastructures 
[RFC5280], and many others. 


The construction described in this document is known as a 
"derandomization". This has been proposed for various signature 
schemes. Security relies on whether the generation of k is 
indistinguishable from the output of a random oracle. Roughly 
speaking, HMAC_DRBG is secure in that role as long as HMAC behaves as 
a PRF (Pseudorandom Function). For details on the security of HMAC 
and HMAC_DRBG, please refer to [H2008] and [B2006]. For a more 
formal treatment of derandomization, see [LN2009]. 


One remaining issue with deterministic (EC)DSA, as presented in this 
document, is the "double use" of the private key x, both as the 
private key in the signature generation algorithm itself and as input 
to the HMAC_DRBG-based pseudorandom oracle for producing the k value. 
This requires HMAC_DRBG to keep on being a random oracle, even when 
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6. 


6. 


the public key (which is computed from x) is also known. Given the 
lack of common structure between HMAC and discrete logarithms, this 
seems a reasonable assumption. 


Side-channel attacks are an important consideration whenever an 
attacker can accurately measure aspects of an implementation such as 
the length of time that it takes to perform a signing operation or 
the power consumed at each point of a signing operation. The 
determinism of the algorithms described in this note may be useful to 
an attacker in some forms of side-channel attacks, so implementations 
SHOULD use defensive measures to avoid leaking the private key 
through a side channel. 


Intellectual Property Status 


To the best of our knowledge, deterministic (EC)DSA is not covered by 
any active patent. The paper [BDLSY2011] points to two independent 
publications of the idea of derandomization by Barwood and Wigley, 
both in early 1997, and also to a patent application by Naccache, 
M'Raihi, and Levy-dit-Vehel a few months later [NML1997], but the 
application was withdrawn in 2003. We are not aware of any other 
patent on the subject. 
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Appendix A. Examples 
A.l. Detailed Example 


We detail here the intermediate values obtained during the generation 
of k on an example message and key. We use a binary curve because 
that specific curve is standard and has a group order length (qlen) 
that is not a multiple of 8; this illustrates the fine details of how 
conversions are performed between integers and bit sequences. 


A.1.1. Key Pair 


We consider ECDSA on the curve K-163 described in [FIPS-186-4] (also 
known as "ansix9t163k1" in [X9.62]). The curve is defined over a 
field GF(2%163): field elements are encoded into 163-bit strings. 
The order of the conventional base point is the prime value: 


q = 0x4000000000000000000020108A2E0CCOD99F 8A5EF 
which has length qlen = 163 bits. 
Our private key is: 
x = 0x09A4D6792295A7F730FC3F2B49CBCOF62E862272F 
The corresponding public key is the curve point U = xG. This point 
has two coordinates, which are elements of the field GF (27163). 


These elements Can be converted to integers using the procedure 
described in Section A.5.6 of [X9.62], yielding the two public point 


coordinates: 
Ux = 0x79AEE090DBO05EC252D5CB4452F356BE198A4FF96F 
Uy = 0x782E29634DDC9A31EF40386E896BAA18B53AFA5A3 


A.1.2. Generation of k 


In this example, we use the hash function SHA-256 [FIPS-180-4]. The 
input message is the UTF-8 encoding of the string "sample" (6 octets, 
i.e., 48 bits). 


The hashed input message hl = SHA-256(m) is: 
h1 


AF 2B DB El AA 9B 6E Cl E2 AD El D6 94 F4 1F C7 
1A 83 1D 02 68 E9 89 15 62 11 3D 8A 62 AD D1 BF 


(32 octets; each octet value is listed in hexadecimal notation). 
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We convert the private key x to a sequence of octets using the 
int2octets transform: 


int2octets (x) 
00 9A 4D 67 92 29 5A TF 73 OF C3 F2 B4 9C BC OF 
62 E8 62 27 2F 


Note: Although the specific value of x would numerically fit in 160 
bits, i.e., 20 octets, we still encode x into 21 octets, because the 
encoding length is driven by the length of q, which is 163 bits. 


We also truncate and/or expand the hashed message using bits2octets: 


bits2octets (h1) 
01 79 5E DF OD 54 DB 76 OF 15 6D OD AC 04 CO 32 
2B 3A 20 42 24 


The steps b to g (see Section 3.2) then compute the values for the K 
and V variables. These variables are sequences of 256 bits (the hash 
function output length, rounded up to a multiple of 8). We reproduce 
here the successive values: 


V after step b: 
01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 
01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 


K after step c: 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 


K after step d: 
09 99 9A 9B FE F9 72 D3 34 69 11 88 3F AD 79 51 
D2 3F 2C 8B 47 F4 20 22 2D 11 71 EE EE AC 5A B8 


V after step e: 
D5 F4 03 OF 75 5E E8 6A Al OB BA 8C 09 DF 11 4F 
F6 B6 11 1C 23 85 00 D1 3C 73 43 A8 CO 1B EC F7 


K after step f: 
OC F2 FE 96 D5 61 9C 9E F5 3C B7 41 7D 49 D3 7E 
A6 8A 4F FE DO D7 E6 23 E3 86 89 28 99 11 BD 57 


V after step g: 
78 34 57 C1 CF 31 48 A8 F2 A9 AE 73 ED 47 2F AY 
8E D9 CD 92 5D 8E 96 4C EO 76 4D EF 3F 84 2B 9A 
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In step h, we perform the final loop. Since we use HMAC with SHA- 
256, which produces 256 bits worth of output, and we need only 163 
bits for T, a single HMAC invocation yields the following T: 


T (first try) 
93 05 A4 6D E7 FF 8E B1 07 19 4D EB D3 FD 48 AA 
20 D5 E7 65 6C BE OE A6 9D 2A 8D 4E 7C 67 31 4A 


which, when converted to an integer with bits2int, yields a first 
Candidate for k: 


k1 = 0x4982D236F3FFC758838CA6F5E9FEA455106AF3B2B 


Since that value is greater than q-1, we have to loop. This first 
entails computing new values for K and V: 


new K 
75 CB 5C 05 B2 A7 8C 3D 81 DF 12 D7 4D 7B EO AO 
E9 4A B1 98 15 78 1D 4D 8E 29 02 A7 9D OA 66 99 
new V 
DC B9 CA 12 61 07 A9 C2 7C E7 7B A5 8E A8 71 C8 
C9 12 D8 35 EA DD C3 05 F2 44 5D 88 F6 6C 4C 43 
then a new T: 
T (second try) 
C7 OC 78 60 8A 3B 5B E9 28 9B E9 OE F6 E8 1A YE 
2C 15 16 D5 75 1D 2F 75 F5 00 33 E4 5F 73 BD EB 
and a new candidate for k: 
k2 = 0x63863C30451DADF4 944DF4877B740D4F160A8B6AB 
Since k2 is also greater than q-1, we loop again: 
new K (2) 


OA 5A 64 B9 9C 05 95 20 10 36 86 CB 6F 36 BC FC 
A7 88 EB 3B CF 69 BA 66 A5 BB 08 OB 05 93 BA 53 


OB 3B 19 68 11 B1 9F 6C 6F 72 9C 43 F3 5B CF OD 
FD 72 5F 17 CA 34 30 E8 72 14 53 E5 55 50 Al 8F 


47 5E 80 E9 92 14 05 67 FC C3 A5 OD AB 90 FE 84 
BC D7 BB 03 63 8E 9C 46 56 AO 6F 37 F6 50 8A 7C 
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A. 


alas 


and we finally get an acceptable value for k: 


k = 0x23AF4074C90A02B3FE61D286D5C87F425E6BDD81B 


3. Signature 


With our private key and the value of k that we just generated, we 

can now compute the signature using the standard ECDSA mechanisms. 

First, the point kG is computed, and the X coordinate of that point 
is converted to an integer and then reduced modulo q, yielding the 

first signature half: 


r = 0x113A63990598A3828C407C0F4D2438D990DF99A7F 


which we use, together with x (the private key), k (which we computed 
above), and h = bits2int (h1), to compute the second signature half: 


s = 0x1313A2E03F5412DDB296A22E2C455335545672D9F 


An ECDSA signature is a pair of integers. In many protocols that 
require a signature to be a sequence of bits (or octets), it is 
customary to encode the signature as an ASN.1 SEQUENCE of two INTEGER 
values, with DER rules. This results in the following 48-octet 
signature: 


30 2E 02 15 01 13 A6 39 90 59 8A 38 28 C4 07 CO 
F4 D2 43 8D 99 OD F9 9A 7F 02 15 01 31 3A 2E 03 
F5 41 2D DB 29 6A 22 E2 C4 55 33 55 45 67 2D 9F 
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A.2. Test Vectors 


In the following sections, we give test vectors for various key sizes 
and hash functions, both for DSA and ECDSA. 


All numbers are given in hexadecimal notation. Each signature 
consists of two integers, named r and s; many implementations will 
encode those integers into a single ASN.1 structure or with some 
other encoding convention, which is outside of the scope of this 
document. We also show the k value used internally. 


For every key, we list ten signatures, corresponding to two distinct 
input messages, and five of the SHA [FIPS-180-4] functions: SHA-1, 
SHA-224, SHA-256, SHA-384, and SHA-512. The two input messages are 
the UTF-8 encoding of the strings "sample" and "test" (without the 
quotes), of length 48 and 32 bits, respectively. 


The ECDSA examples use the standard curves described in [FIPS-186-4]. 


Pornin Informational [Page 24] 


RFC 6979 Deterministic DSA and ECDSA August 2013 


A.2.1. DSA, 1024 Bits 
Key pair: 
key parameters: 
p = 86F5CA03DCFEB225063FF830A0C769B9DD9DE153AD91D7CE27F787C43278B447 
£6533B86B18BED6E8A4 8B784A14C252C5BEODBF 60B8 6D6385BD2F12FB763ED88 


73ABFD3F5BA2E0A8C0A59082EAC056935E529DAF7C610467899C77ADEDFC846C 
881870B7B19B2B58F9BE0521A17002E3BDD6B86685EE90B3D9A1B02B782B1779 


a = 996F967F6C8E388D9E28D01E205FBA957A5698B1 


g = 07B0F92546150B62514BB771E2A0COCE387F03BDA6C56B505209FF25FD3C133D 
89BBCD97E904E09114D9A7DEFDEADFC9078EA544D2E401AEECC40BB9FBBF78FD 
87995A10A1C27CB7789B594BATEFB5C4326A9FE59A070E136DB77175464ADCA4 
17BE5DCE2F40D10A46A3A3943F26AB7FD9C0398FF8C76EE0A56826A8A88F1DBD 


private key: 

x = 411602CB19A6CCC34494D79D98EF1E7ED5AF25F7 

public key: 

y = 5DF5E01DED31D0297E274E1691C192FE5868FEF 9E19A84776454B100CF16F653 
92195A38B90523E2542EE61871C0440CB87C322FC4B4D2EC5E1E7EC766E1BE8D 


4CE93543'7DC11C3C8FD426338933EBFE739CB3465F4D3668C5E473508253B1E6 
82F65CBDC4FAE93C2EA212390E54905A86E2223170B44EAA7DA5DD9FFCFB7F3B 


Signatures: 


With SHA-1, message = "sample": 

k = 7BDB6BOFF756E1BB5D53583EF979082F 9AD5BD5B 
r = 2E1A0C2562B2912CAAF89186FBOF42001585DA55 
s = 29EFB6BOAFF2D7A68EB70CA313022253B9A88DF'5 


With SHA-224, message = "sample": 

k 562097C06782D60C3037BA7BE104774344687649 
r = 4BC3B686AEA70145856814A6F1BB53346F02101E 
s = 410697B92295D994D21EDD2F4ADA85566F6F94C1 


With SHA-256, message = "sample": 

k = 519BA0546D0C39202A7D34D7DFA5E760B318BCFB 
r = 81F2F5850BE5BC123C43F71A3033E9384611C545 
s 4CDD914B65EB6C66A8AAAD27299BEE6B035F5E89 
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With SHA-384, message = "sample": 

k = 95897CD7BBB944AA932DBC579C1C09EB6FCFC595 
r = 07F2108557EE0E3921BC1774F1CA9B410B4CE65A 
s 54DF70456C86FAC10FAB47C1949AB83F2C6F7595 


With SHA-512, message = "sample": 

k = 09ECE7CA27D0F5A4DD4E556C9DF1D21D28104F8B 
r = 16C3491F9B8C3FBBDD5E7A7B667057F0D8EE8E1B 
s 02C36A127A7B8 9EDBB72E4FFBC71DABC7D4FC69C 


With SHA-1, message = "test": 

k = 5C842DF4F9E344EE09F056838B42C7A17F4A6433 
E 42AB2052FD43E123F0607F115052A67DCD9C5C77 
s 183916B0230D45B9931491D4C6BOBD2FB4AAF088 


With SHA-224, message = "test": 

k = 4598B8EFC1A53BC8AECD58D1ABBBOCOC71E67297 
r = 6868E9964E36C1689F6037F91F28D5F2C30610F2 
s = 49CEC3ACDC83018C5BD2674ECAAD35B8CD22940F 


With SHA-256, message = "test": 

k = 5A67592E8128E03A417B0484410FB72C0B630E1A 
r = 22518C127299B0F6FDC9872B282B9E70D0790812 
s 6837EC18F150D55DE95B5E2 9BE7AF5D01E4FE160 


With SHA-384, message = "test": 

k = 220156B761F6CA5E6C9FIBYICF 9C24BE25F98CD89 
r = 854CF929B58D73C3CBFDC421E8D5430CD6DB5E66 
s 91D0E0F53E22F898D158380676A871A157CDA622 


With SHA-512, message = "test": 

k = 65D2C2EEB175E370F28C75BFCDC0O28D22C7DBE9C 
r = 8EA47E475BA8AC6F2D821DA3BD212D11A3DEB9A0 
s 7C670C7AD72B6C050C109E1790008097125433E8 
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A.2.2. DSA, 2048 Bits 
Key pair: 
key parameters: 


p = 9DB6FB5951B66BB6FE1E140F1D2CE5502374161FD6538DF1648218642F0B5C48 
C8F7A41AADFA187324B87674FA1822B00F1ECF8136943D7C55757264E5A1A44F 
FE012E9936E00C1D3E9310B01C7D179805D3058B2A9F4BB6F9716BFE6117C6B5 
B3CC4D9BE341104AD4A80AD6C94E005F4B993E14F091EB51743BF33050C38DE2 
35567E1B34C3D6A5C0CEAA1A0F368213C3D19843D0B4BO09DCB9FC72D39C8DE41 
F1BF14D4BB4563CA28371621CAD3324B6A2D392145BEBFAC748805236F5CA2FE 
92B871CD8F9C36D3292B5509CA8CAA77A2ADFC7BED77DDA6F71125A7456FEA15 
3E433256A2261C6A06ED3693797E7995FADS5AABBCFBE3EDA2741E375404AE25B 


T 


q = F2C3119374CE76C9356990B465374A17F23F9ED35089BD969F61C6DDE9998C1F 


g = 5C7FF6BO6F8F143FE8288433493E4769C4D988ACE5BE25A0E24809670716C613 
D7BOCEE6932F8FAA7C44D2CB24523DA53FBE4F6EC3595892D1AA58C4328A06C4 
6A15662E7EAA703A1DECF8BBB2D05DBE2EB956C142A338661D10461C0D135472 
085057F3494309FFA73C611F78B32ADBB5740C361C9F35BE90997DB2014E2EF5 
AA61782F52ABEB8BD6432C4DD097BC5423B285DAFB60DC364E8161F4A2A35ACA 
3A10B1C4D203CC76A470A33AFDCBDD92959859ABD8B56E1725252D78EAC66E71 
BA9AE3F1DD2487199874393CD4D832186800654760E1E34C09E4D155179F9EC0O 
DC4473F996BDCE6EED1CABED8B6F116F 7AD9CF505DFOF998E34AB27514BOFFE7 


private key: 
x = 69C7548C21D0DFEA6B9A51C 9EAD4E27C33D3B3F180316E5BCABI2C933F0E4DBC 
public key: 


y = 667098C654426C78D7F8201EAC6C203EF030D43605032C2F1FA937E5237DBD94 
9F34A0A2564FE126DC8B715C5141802CE0979C8246463C40E6B6BDAA2513FA61 
1728716C2E4FD53BC95B89E69949D96512E873B9C8F8DFD499CC312882561ADE 
CB31F658E934C0C197F2C4D96BO5CBAD67381E7B768891E4DA3843D24D94CDFB 
5126E9B8BF21E8358EE0E0A30EF13FD6A664C0DCE3731F"7FB49A4845A4FD8254 
687972A2D382599C9BAC4E0ED7998193078913032558134976410B89D2C171D1 
23AC35FD977219597AA7D15C1A9A428E59194F75C721EBCBCFAE44696A499AFA 
74E04299F132026601638CB87AB79190D4A0986315DA8EEC6561C938996BEADF 


Signatures: 


With SHA-1, message = "sample": 

k = 888FA6F7738A41BDC9846466ABDB8174C0338250AE50CE955CA16230F9CBD53E 
r = 3A1B2DBD7489D6ED7E608FD036C83AF396E290DBD602408E8677DAABD6E7445A 
sS D2 6FCBA1 9FA3E3058FFC02CA1596CDBB6E0D20CB37B06054F7E36DEDOCDBBCCF 
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With SHA-224, message = "sample": 

k = BC372967702082E1AA4FCE8 9220 9F71AE4AD2 5A6DFD869334E6F153BD0C4D806 
r = DCIFA4DEADA8D8FF588E98FEDOAB690FFCE858DC8C79376450EB6B76C24537E2C 
s A65A9C3BC7BABE2 8 6B195D5DA68 616DA8D47FA0097F36DD19F517327DC848CEC 


With SHA-256, message = "sample": 
k = 8926A27C4048421 6F052F4427CFD5647338B7B3939BC657 3AF4333569D597C52 
r = EACE8BDBBE353C432A795D9EC556C6D021F7A03F42C36E9BC87E4AC7932CC809 
s 7081E175455F9247B812B74583E9E94F9EA79BD640DC962533B0680793A38D53 


With SHA-384, message = "sample": 
k = C345D5AB3DA0A5BCB7EC8F8FB7A7E96069E03B206371EF7D83E39068EC564920 
E B2DA945E91858834FD9BF616EBAC151EDBC4B45D27D0DD4A7F6A22739F45C00B 
s 19048B63D9FD6BCA1D9BAE3664E1BCB97F7276C306130969F63F38FA8319021B 


With SHA-512, message = "sample": 

k = 5A12994431785485B3F5F067221517791B85A597B7A9436995C89ED0374668FC 
r = 2016ED092DC5FB669B8EFB3D1F31A91EECB199879BEOCF78F02BA062CB4C942E 
s = DOC76F84B5F091E141572A639A4FB8C230807EEA7D55C8A154A224400AFF2351 


With SHA-1, message = "test": 

k = 6EEFA486F9D41A037B2C640BC5645694FF8FF4B98D066A25F7 6BE641CCB24BA4F 
r = C18270A93CFC6063F57A4DFA86024F700D980E4CF4E2CB65A504397273D98EA0 
s 414F22E5F31A8B6D33295C7539C1C1BA3A6160D7D68D50ACOD3A5BEAC2884FAA 


With SHA-224, message = "test": 

k 06BD4C05ED74719106223BE33F2D95DA6B3B541DAD7BFBD7AC508213B6DA6670 
r = 272ABA31572F6CC55E30BF616B7A265312018DD325BE031BE0CC82AA17870EA3 
s E9CC286A52CCE201586722D36D1E917EB96A4EBDB47932F9576AC645B3A60806 


With SHA-256, message = "test": 

k = 1D6CE6DDA1C5D37307839CD03AB0A5CBB18E60D800937D67DFB4 47 9AAC8DEAD7 
r = 8190012A1969F9957D56FCCAAD223186F423398D58EF5B3CEFD5A4146A4476F0 
sS 7452A53F7075D417B4B013B278D1BB8BBD21863F5E7B1CEE679CF2188E1AB19E 


With SHA-384, message = "test": 
k = 206E61F73DBE1B2DC8BE736B22B079E9DACD974DBO0EEBBC5B64CAD39CF9F91C 
r = 239E66DDBE8F8C230A3D071D601B6FFBDFB5901F94D444C6AF56F732BEB954BE 
s 6BD737513D5E72FE85D1C750E0F73921FE299B945AAD1C802F15C26A43D34961 


With SHA-512, message = "test": 

k = AFF1651E4CD6036D57AA8B2A05CCF1A9D5A40166340ECBBDC55BE10B568AA0AA 
r = 89EC4BB1400ECCFF8E7D9AA515CD1DE7803F2DAFF09693EE7FD1353E90A68307 
s = C9FOBDABCCOD880BB137A994CC7F3980CE91CC1OFAF529FC46565B15CEA854E1 
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ECDSA, 192 Bits (Prime Field) 
y pair: 
rve: NIST P-192 


= FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831 


qlen = 192 bits) 


ivate key: 


= 6FAB034934E4COFC9AE67F5B5659A9D7D1FEFD187EE09FD4 


blic key: U = xG 


AC2C77F529F 9168 9FEAORASEFEC7F210D8EEA0B9IE047ED56 


3BC723E57670BD4887EBC732C523063D0A7C957BC97C1C43 


gnatures: 


th SHA-1, message = "sample": 

= 37D7CA00D2C7BOE5E412AC03BD44BA837FDD5B28CD3B0021 
98C6BD12B23EAF5E2A2045132086BE3EB8EBD62ABF6698FF 
57A22B07DEA9530F8DE9471B1DC6624472E8E2844BC25B64 


th SHA-224, message = "sample": 

= 4381526B3FC1E7128F202E194505592F01D5FF4C5AF015D8 
A1FOODAD97AEEC91C95585F36200C65F3C01812AA60378F5 
= E07EC1304C7C6C9DEBBE980B9692668F81D4DE7922A0F97A 


th SHA-256, message = "sample": 

32B1B6D7D42A05CB449065727A84804FB1A3E34D8F261496 
= 4B0B8CE98A92866A2820E20AA6B75B56382E0F9BFD5ECB55 
= CCDBO06926EA9565CBADC840829D8C384E06DE1F1E381B85 


th SHA-384, message = "sample": 

= 4730005C4FCB01834C063A7B6760096DBE284B8252EF4311 
DA63BFOB9ABCF 948FBB1E9167F136145F7A20426DCC287D5 
= C3AA2C960972BD7A2003A57E1C4C77F0578F8AE95E31EC5E 


th SHA-512, message = "sample": 

= A2AC7ABO055E4F20692D49209544C203A7D1F2COBFBC75DB1 
4D60C5AB1996BD848343B31C00850205E2EA6922DAC2E4B8 
3F6E837448F027A1BF4B34E796E32A811CBB4050908D8F67 
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With SHA-1, message = "test": 


k = 
r= 
S 


With SHA-224, message = "test": 


k = 
LS 
S 


D9CF9C3D3297D3260773A1DA7418DB5537AB8DD93DE7FA25 
OF2141A0EBBC44D2E1AF 90A50EBCFCE5E197B3B7D4DE03 6D 
EB18BC9E1F3D7387500CB99CF5F7C157070A8961E38700B7 


F5DC805F76EF851800700CCE82E7B98D8911B7D510059FBE 
6945A1C1D1B2206B8145548F633BB61CEF04891BAF26ED34 
B7FB7FDFC33 9COB9BD61A9F 5A8EAF 9BE58FC5CBA2CB15293 


With SHA-256, message = "test": 


k = 
Y 
S 


5C4CE89CF56D9E7C77C8585339B006B97B5F0680B4306C6C 
3A718BD8B4926C3B52EE6BBE67EF79B18CB6EB62B1AD97AE 
5662E6848A4A19B1F1AE2F72ACD4B8BBE50F1EAC65D9124F 


With SHA-384, message = "test": 
k = 5AFEFB5D3393261B828DB6C91FBC68C230727B030C975693 
r = B234B60B4DB75A733E1 9280A7A6034BD6B1EE8 8AF5332367 
s = 7994090B2D59BB782BE57E74A44C9A1C700413F8ABEFE77A 
With SHA-512, message = "test": 
k = 0758753A5254759C7CFBAD2E2D9B0792EEE44136C9480527 
r = FE4F1AE86A58B6507946715934FE2D8FF9D95B6B098FE739 
s = 74CF5605C98FBAOCE1EF34D4B5A1577A7DCF59457CAE52290 
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ECDSA, 224 Bits (Prime Field) 
y pair: 
rve: NIST P-224 


= FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D 


qlen = 224 bits) 


ivate key: 


= F220266E1105BFE3083E03EC7A3A654651F45E37167E88600BF257C1 


blic key: U = xG 


00CFO08DA5AD719E42707FA431292DEA11244D64FC51610D94B130D6C 


EEAB6F3DEBE455E3DBF85416F7030CBD94F34F2D6F232C69F3C1385A 


gnatures: 


th SHA-1, message = "sample": 

7EEFADD91110D8DE6C2C470831387C50D3357F7F4D477054B8B42 6BC 
= 22226F9D40A96E19C4A301CE5B74B115303C0F3A4FD30FC257FB57AC 
66D1CDD83E3AF75605DD6E2FEFF196D30AA7ED7A2EDF7AF475403D69 


th SHA-224, message = "sample": 

= C1D1F2F10881088301880506805FEB4825FE09ACB6816C36991AA06D 
1CDFE6662DDE1E4A1EC4CDEDF 6A1F5A2FB7FBD9145C12113E6ABFD3E 
= A6694FD7718A21053F225D3F46197CA699D45006C06F871808F43EBC 


th SHA-256, message = "sample": 

AD3029E0278F80643DE33917CE6908C70A8FF50A411F06E41DEDFCDC 
61AA3DAO10E8E8406C656BC477A7A7189895E7E840CDFE8FF42307BA 
BC814050DAB5D23770879494F9E0A680DC1AF7161991BDE692B10101 


th SHA-384, message = "sample": 
= 52B40F5A9D3D13040F494E83D3906C6079F29981035C7BD51E5CAC40 
0B115E5E36F0F9EC81F1325A5952878D745E19D7BB3EABFABA77E953 
= 830F34CCDFE826CCFDC81EB4129772E20E122348A2BBD889A1B1AF1D 


th SHA-512, message = "sample": 

9DB103FFEDEDF 9CFDBA05184F925400C1653B8501BAB8 9CEAOFBEC14 
074BD1D979D5F32BF958DDC61E4FB4872ADCAFEB2256497CDAC30397 
A4CECA196C3D5A1FF31027B33185DC8EE43F288B21AB342E5D8EB084 
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With SHA-1, message = "test": 

k = 2519178F82C3F0E4F87ED5883A4E114E5B7A6E374043D8EFD329C253 
r = DEAA646EC2AF2EA8AD53ED66B2E2DDAA49A12EFD8356561451F3E21C 
s 95987796F 6CF2062AB8135271DE5 6AE55366C045F6D9593F53787BD2 


With SHA-224, message = "test": 

k = DF8B38D40DCA3E077D0AC520BF56B6D565134D9B5F2EAE0D34900524 
r = C441CE8E261DED634E4CF84 910E4C5D1D22C5CF3B732BB204DBEF019 
s 902F42847A63BDC5F6046ADA114953120F99442D76510150F372A3F4 


With SHA-256, message = "test": 
k = FF86F57924DA248D6E44E8154EB69FO0OAE2AEBAEE9931D0B5A969F 904 
r = ADO4DDE87B84747A243A631EA47A1BA6D1FAA05 914 9AD2440DE6FBA6 
sS 178D49B1AE90E3D8B629BE3DB5683915F4E8C99FDF6E666CF37ADCFD 


With SHA-384, message = "test": 
k = 7046742B839478C1B5BD31DB2E862AD868E1A45C863585B5F22BDC2D 
r = 389B92682E399B26518A95506B52C03BC9379A9DADF3391A21FBOEA4 
s = 414A718ED3249FF6DBC5B50C27F71F01F070944DA22AB1F78F559AAB 


With SHA-512, message = "test": 
k = E39C2AA4EA6BE2306C72126D40ED77BF9739BB4D6EF2BBB1DCB6169D 
r = 049F050477C5ADD858CAC56208394B5A55BAEBBE887FDF765047C17C 
s 077EB13E7005929CEFA3CD0403C7CDCC077ADF4E44F3C41B2F60ECFF 
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ECDSA, 256 Bits (Prime Field) 
y pair: 
rve: NIST P-256 


= FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551 


qlen = 256 bits) 


ivate key: 


= C9AFA9D845BA75166B5C215767B1D6934E50C3DB36E89B127B8A622B120F6721 


blic key: U = xG 


60FED4BA255A9D31C961EB74C6356D68C049B8923B61FA6CE669622E60F29FB6 


7903FE1008B8BC99A41AE9E95628BC64F2F1B20C2D7E9F5177A3C294D4462299 
gnatures: 


th SHA-1, message = "sample": 

882905F1227FD620FBF2ABF21244F0BA83D0DC3A9103DBBEE4 3A1FB858109DB4 
61340C88C3AAFBEB4F6D667F672CA975 9A6CCAAIFA8 81131303 9EE4A35471D32 
6D7F147DAC089441BB2E2FE8F7A3FA264B9C475098FDCF6E00D7C996E1B8B7EB 


th SHA-224, message = "sample": 

= 103F90EE9DC52E5E7FB5132B7033C63066D194321491862059967C715985D473 
53B2FFF5D1752B2C689DF257C04C40A587FABABB3F6FC2702F1343AF7CA9AA3F 
= B9AFB64FDCO3DC1A131C7D2386D11E349F070AA432A4ACC918BEA988BF75C74C 


th SHA-256, message = "sample": 

A6E3C57DD01ABE90086538398355DD4C3B17AA873382B0F24D6129493D8AAD60 
= EFD48B2AACB6A8FD1140DD9CD45E81D69D2C877B56AAF991C34D0EA84EAF3716 
= F7CB1C942D657C41D436C7A1B6E29F65F3E900DBB9AFF4064DC4AB2F843ACDA8 


th SHA-384, message = "sample": 

= 09F634B188CEFD98E7EC88B1AA9852D734D0BC272F7D2A47DECC6EBEB375AAD4 
OEAFEA0O39B20E9B42309FB1D89E213057CBF973DC0CFC8F129EDDDC800EF 7719 
= 4861F0491E6998B9455193E34E7B0D284DDD7149A74B95B9261F13ABDE940954 


th SHA-512, message = "sample": 

5FA81C63109BADB88C1F367B47DA606DA28CAD69AA22C4FE6AD7DF73A7173AA5 
8496A60B5E9B47C825488827E0495B0E3FA109EC4568FD3F8D1097678EB97F00 
2362AB1ADBE2B8ADF 9CB9EDAB740EA6049C028114F2460F96554F61FAE3302FE 
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With SHA-1, message = "test": 

k 8C9520267C55D6B980DF741E56B4ADEE114D84FBFA2E62137954164028632A2E 
r = OCBCC86FD6ABD1D99E703E1EC50069EE5C0B4BA4B9AC60E409E8EC5910D81A89 
s 01B9D7B73DFAA60D5651EC4591A0136F87653E0FD780C3B1BC872FFDEAE479B1 


With SHA-224, message = "test": 

k 669F4426F2688B8BEODB3A6BD1989BDAEFFF84B649EEB84F3DD26080F667FAA7 
r = C37EDB6F0AE79D47C3C27E962FA269BB4F441770357E114EE511F662EC34A692 
s C820053A05791E521FCAAD6042D40AEA1D6B1A540138558F47D0719800E18F2D 


With SHA-256, message = "test": 

k = D16B6AE827F17175E040871A1C7EC3500192C4C92677336EC2537ACAEE0008E0 
r F1ABB023518351CD71D881567B1EA663ED3EFCF6C5132B354F28D3B0B7D38367 
s 019F4113742A2B14BD25926B49C649155F267E60D3814B4C0CC84250E46F0083 


With SHA-384, message = "test": 
k 16AEFFA357260B04B1DD199693960740066C1A8F3E8EDD79070AA914D361B3B8 
r = 83910E8B48BB0C74244EBDF7F07A1C5413D61472BD941EF3920E623FBCCEBEB6 
s = 8DDBEC54CF8CD5874883841D712142A56A8D0F218F5003CB0296B6B509619F2C 


With SHA-512, message = "test": 

k = 6915D11632ACA3C40D5D51C08DAF9C555933819548784480E93499000D9F0OB7F 
r = 461D93F31B6540894788FD206C07CFA0OCC35F46FA3C91816FFF1040AD1581A04 
s 39AF9F15DE0DB8D97E72719C74820D304CE5226E32DEDAE67519E840D1194E55 
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A.2.6. ECDSA, 384 Bits (Prime Field) 
Key pair: 
curve: NIST P-384 
q = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF 


581A0DB248B0A77AECEC196ACCC52973 
(qlen = 384 bits) 


private key: 


x = 6B9D3DAD2E1B8C1C05B19875B6659F4DE23C3B667BF297BA9AA47740787137D8 
96D5724E4C70A825F872C9EA60D2EDF5 


public key: U = xG 


Ux = EC3A4E415B4E19A4568618029F 42 7FA5DA9SA8BC4AE 9I2E02E0 6AAE5286B300C64 
DEF 8F0EA9055866064A254515480BC13 

Uy = 8015D9B72D7D57244EA8EF9AC0C621896708A59367F9DFB9F54CA84B3F1C9DB1 
288B231C3AE0D4FE7344FD2533264720 

Signatures: 

With SHA-1, message = "sample": 

k = 4471EF7518BB2C7C20F62EAE1C387AD0C5E8E470995DB4ACF694466E6AB09663 


OF29E5938D25106C3C340045A2DBO01A7 

EC748D839243D6FBEF4FC5C4859A7DFFD7F3ABDDF72014540C16D73309834FA3 

7B9BA002899F 6FDA3A4A9386790D4EB2 

s = A3BCFA947BEEF4732BF247AC17F71676CB31A847B9FFOCBC9C9ED4C1A5B3FACF 
26F49CA031D4857570CCB5CA4424A443 


K 
ll 


With SHA-224, message = "sample": 

k = AZ4E4D2F0E729EB786B31FC20AD5D849E304450E0AE8E3E341134A5C1AFAO3CAB 
8083EE4E3C45B06A5899EA56C51B5879 

r = 42356E76B55A6D9B4631C865445DBE54E056D3B3431766D0509244793C3F9366 
450F76EE3DE43F5A125333A6BE060122 

s = 9DA0C81787064021E78DF658F2FBB0B042BF304665DB721F077A4298B095E483 
4C082C03D83028EFBF 93A3C23940CA8D 


With SHA-256, message = "sample": 

k 180AE9F9AEC5438A44BC159A1FCB277C7BE54FA20E7CF404B490650A8ACC414E 
375572342863C899F9F2EDF9747A9B60 

r = 21B13D1E£013C7FA1392D03C5F99AF8B30C570C6F98D4EA8E354B63A21D3DAA33 

BDE1E888E63355D92FA2B3C36D8FB2CD 

F3AA443FB107745BF4BD77CB3891674632068A10CA67E3D45DB2266FA7D1FEEB 

EFDC63ECCD1AC42EC0CB8668A4FAOABO 


n 
ll 
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With SHA-384, message = "sample": 

k 94ED910D1A099DAD3254E9242AE8 5ABDE4BA15168EAFOCA87A555FD56D10FBCA 
2907E3E83BA95368623B8C4686915CF9 
94EDBB92A5ECB8AAD4736E56C691916B3F88140666CE9FA73D64C4EA95AD133C 
81A648152E44ACF96E36DD1E80FABE46 
99EF4AEB15F178CEA1FE40DB2603138F130E740A19624526203B6351D0A3A94F 
A329C145786E679E7B82C71A38628AC8 


K 
ll 


n 
ll 


With SHA-512, message = "Sample": 

k = 92FC3C7183A883E24216D1141F1A8976C5BODD797DFA597E3D7B32198BD35331 
A4E966532593A52980D0E3AAA5E10EC3 

r = EDO959D5880AB2D869AE7F6C2915C6D60F96507F9CB3E047C0046861DA4A799C 
FE30F35CC900056D7C99CD7882433709 

s = 512C8CCEEE3890A84058CE1E22DBC2198F42323CE8ACA9135329F03C068E5112 
DC7CC3EF 344 6DEFCEBO1A45C2667FDD5 


With SHA-1, message = "test": 

k 66CC2C8F4D303FC962E5FF6A27BD79F84EC812DDAE58CF5243B64A4AD8094D47 
EC3727F3A3C186C15054492E30698497 

r = 4BC35D3A50EF4E30576F58CD96CE6BF638025EE624004A1F7789A8B8E43D0678 
ACD9D29876DAF46638645F7F404B11C7 

s = D5A6326C494ED3FF614703878961C0FDE7B2C278F9A65FD8C4B7186201A29916 
95BA1C84541327E966FA7B50F 7382282 


With SHA-224, message = "test": 

k = 18FA39DB95AA5F561F30FA3591DC5 9COFA3 653A8 0DAFFA0B4 8D1A4C6DFCBFF 6E 
3D33BE4DC5EB888 6A8ECD093F 2935726 

r = E8C9DOB6EA72A0E7837FEA1D14A1A9557F29FAA45D3E7EE888FC5BF954B5E624 
64A9A817C47FF78B8C11066B24080E72 

s = 07041D4A7A0379AC7232FF72E6F77B6DDB8F09B16CCE0EC3286B2BD43FA8C614 
1C53EA5ABEF0D8231077A04540A96B66 


T 


With SHA-256, message = "test": 

k 0CFAC37587532347DC3389FDC98286BBA8C73807285B184C83E62E26C401C0FA 
A48DD070BA79921A3457ABFF2D630AD7 

r = 6D6DEFAC9AB64DABAFE3 6C6BF510352A4CC27001263638E5B16D9BB51D451559 
F918EEDAF 22 93BE5B475CC8F0188636B 

s = 2D46F3BECBCC523D5F1A1256BF0C9B024D879BA9E838144C8BA6BAEB4B53B47D 
51AB373F9845C0514EEFB14024787265 


With SHA-384, message = "test": 

k = 015EE46A5BF88773ED9123A5AB0807962D193719503C527B031B4C2D225092AD 
A71F4A45 9BCODA98ADB95837DB8312EA 

r = 8203B63D3C853E8D77227FB377BCF7B7B772E978 92A80F36AB775D509D7A5FEB 
0542A7F0812998DA8F1DD3CA3CF023DB 

s = DDD0760448D42D8A43AF45AF836FCE4DE8BE06B485E9B61B827C2F13173923E0 
6A739F04064 9A667BF3B82824 6BAA5A5 
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With SHA-512, message = "test": 


k = 


Pornin 


3780C4F67CB15518B6ACAE34C9F83568D2E12E47DEAB6C50A4E4EE5319D1E8CE 
0E2CC8A136036DC4B9C00E6888F66B6C 
A0D5D090C9980FAF3C2CE57B7AE951D31977DD11C775D314AF55F76C676447D0 
6FB6495CD21B4B6E340FC236584FB277 
976984E59B4C77B0E8E4460DCA3D9F20E07B9BB1F63BEEFAF576F6B2E8B22463 
4A2092CD3792E015 9AD 9CEE37659C736 
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A. 


2. 


7. ECDSA, 521 Bits (Prime Field) 
Key pair: 
curve: NIST P-521 


q = 1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 
FFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386 
409 

(qlen = 521 bits) 


private key: 
x = 0FAD06DAA62BA3B25D2FB40133DA757205DE67F5BB0018FEE8C86E1B68C7E75C 


AA896EB32F1F47C70855836A6D16FCC1466F6D8FBEC67DB89ECOC08B0E996B83 
538 


public key: U = xG 


Ux = 1894550D0785932E00EAA23B694F213F8C3121F86DC97A04E5A7167DB4E5BCD3 
71123D46E45DB6B5D5370A7F20FB633155D38FFA16D2BD761DCAC474B9A2F502 
3A4 


Uy = 0493101C962CD4D2FDDF782285E64584139C2F91B47F87FF82354D6630F746A2 
8A0DB25741B5B34A828008B22ACC23F924FAAFBD4D33F81EA66956DFEAA2BFDF 
CES 


Signatures: 


With SHA-1, message = "sample": 

k = 089C071B419E1C2820962321787258469511958E80582E95D8378E0C2CCDB3CB 
42BEDE42F50E3FA3C71F5A76724281D31D9C89F0F91FC1BE4918DB1C03A5838D 
0F9 

r = 0343B6EC45728975EA5CBA6659BBB6062A5FF89EEA58BE3C80B619F322C87910 
FE092F7D45BBOF8EEE0O1ED3F20BABECO79D202AE677B243AB40B5431D497C55D 
75D 

s = 0E7B0E675A9B24413D448B8CC119D2BF7B2D2DF032741C096634D6D65DODBE3D 
5694625FB9E8104D3B842C1B0E2D0B98BEA19341E8676AEF66AE4EBA3D5475D5 
D16 
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With SHA-224, message = "sample": 

k = 121415EC2CD7726330A61F7F3FA5DE14BE9436019C4DB8CB4041F3B54CF31BE0 
493EE3F427FB906393D895A19C9523F3A1D54BB8702BD4AA9C99DAB2597B9211 
3F3 

r = 1776331CFCDF927D666E032E00CF776187BC9FDD8E69DODABB4109FFE1B5E2A3 
0715F4CC923A4A5E94D2503E9ACFED92857B7F31D7152E0F8C00C15FF3D87E2E 
D2E 

s = 050CB5265417FE2320BBB5A122B8E1A32BD699089851128E360E620A30C7E17B 
A41A666AF126CE100E5799B153B60528D5300D08489CA9178FB610A2006C254B 
41F 


With SHA-256, message = "sample": 

k = OEDF38AFCAAECAB4383358B34D67C9F2216C8382AAEA44A3DAD5FDC9C3257576 
1793FEF24EBOFC276DFC4F 6E3EC476752F043CF01415387470BCBD8678ED2C7E 
1A0 

r = 1511B8B4D675114FE266FC4372B87682BAECCO1D3CC62CF2303C92B3526012659 
D16876E25C7C1E57648F23B73564D67F61C6F14D527D54972810421E7D87589E 
1A7 

s = 04A171143A83163D6DF460AAF61522695F207A58B95C0644D87E52AA1A347916 
E4F7A72930B1BC06DBE22CE3F58264AFD23704CBB63B29B931F7DE6C9D949A7E 
CFC 


With SHA-384, message = "sample": 

k = 1546A108BC23A15D6F21872F7DED661FA8431DDBD922D0DCDB77CC878C8553FF 
AD064C95A920A750AC9137E527390D2D92F153E66196966EA554D9ADFCB109C4 
211 

r = 1EA842A0E17D2DE4F92C15315C63DDF72685C18195C2BB95E572B9C5136CA4B4 
B576AD712A52BE9730627D16054BA40CC0B8D3FF035B12AE75168397F5D50C67 
451 

s = 1F21A3CEE066E1961025FB048BD5FE2B7924D0CD797BABE0OA83B66F1E35EEAFS5S 
FDE143FA85DC394A7DEE7 665233937844 84BDF3E00114A1C857CDE1AA203DB65 
D61 


With SHA-512, message = "sample": 

k = 1DAE2EA071F8110DC26882D4D5EAE0621A3256FC8847FB9022E2B7D28E6F1019 
8B1574FDD03A9053C08A1854A1 68AA5A57470EC97DD5CE090124EF52A2F7ECBF 
FD3 

r = 0C328FAFCBD79DD77850370C46325D987CB525569FB63C5D3BC53950E6D4C5F1 
74E25A1EE9017B5D450606ADD152B534931D7D4E8455CC91F 9B15BF05EC36E37 
7FA 

s = 0617CCE7CF5064806C467F678D3B4080D6F1CC50AF26CA209417308281B68AF2 
82623EAA63E5B5C0723D8B8C37FF0777B1A20F8CCB1DCCC43997F1EE0E44DA4A 
67A 
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With SHA-1, message = "test": 

k = OBB9F2BF4FE1038CCF4DABD7139A56F6FD8BB1386561BD3C6A4FC818B20DF5DD 
BA80795A947107A1AB9D12DAA615B1ADE4F7A9DCO5E8E6311150F47F5C57CE8B 
222 

r = 13BAD9F29ABE20DE37EBEB823C252CA0F63361284015A3BF430A4 6AAA80B87B0 
693F0694BD8 8AFE4E661FC33B0 94CD3B7 963BED5A727ED8BD 6A3A202ABE009D0 
367 

s = 1E9BB81FF7944CA409AD138DBBEE2 2 8E1AFCCO0C890FC78EC8 60463 9CBODBDC9I0 
F717A99EAD9D272855D00162EE9527567DD6A92CBD 62 9805C0445282BBC91679 
7FF 


With SHA-224, message = "test": 

k = 040D09FCF3C8A5F62CF4FB223CBBB2B9937F6B0577C27020A99602C25A011369 
87E452988781484EDBBCF1C47E554E7FC901BC3085E5206D9F619CFF07E73D6F 
706 

r = 1C7ED902E123E6815546065A2C4AF977B22AA8EADDB68B2C1110E7EA44D42086 

BFE4A34B67DDC0E17E96536E358219B23A706C6A6E16BA77B65E1C595D43CAE1 

7FB 

s = 177336676304FCB343CE028B38E7B4FBA76C1C1B277DA18CAD2A8478B2A9A9F5 

BECOF3BA04F35DB3E4263569EC6AADE8C92746E4C82F8299AE1B8F1739F8FD51 

9A4 


With SHA-256, message = "test": 

k = 01DE74955EFAABC4C4F17F8E84D881D1310B5392D7700275F82F145C61E84384 
1AF09035BF7A6210F5A431A6A9E81C9323354A9E69135D44EBD2FCAA7731B909 
258 

r = 00E871C4A14F993C6C7369501900C4BC1E9C7B0B4BA44E04868B30B41D807104 
2EB28C4C250411D0CE08CD197E4188EA4876F279F90B3D8D74A3C76E6F1E4656 
AA8 

s = O0CD52DBAA33B063C3A6CD8058A1FB0A46A4754B034FCC644766CA1 4DA8CA5SCA9 
FDEOOE88C1AD60CCBA759025299079D7A427EC3CC5B61 9BFBC828E7769BCD694 
E86 


With SHA-384, message = "test": 

k = 1F1FC4A34 9A7DA9A9E116BFDD055DC08E78252FF8E23AC276AC88B1770AE0B5D 
CEB1ED14A4916B769A523CE1E90BA2284 6AF11DF8B300C38818F713DADD85DE0 
C88 

r = 14BEE21A18B6D8B3C93FAB08D43E739707953244FDBE924FA926D76669E7AC8C 
89DF62ED8975C2D8397A65A49DCC09F6B0AC62272741924D479354D74FF60755 
78C 

s = 133330865C067A0EAF72362A65E2D7BC4E461E8C8995C3B6226A21BD1AA78F0E 
D94FE536A0DCA35534F0CD1510C41525D163FE9D74D134881E35141ED5E8E95B 
979 
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With SHA-512, message = "test": 

k = 16200813020EC986863BEDFC1B121F605C1215645018AEA1A7B215A564DE9EB1 
B38A67AA1128B80CE391C4FB71187654AAA3431027BFC7F395766CA988C964DC 
56D 

r = 13E99020ABF5CEE7525D16B69B229652AB6BDF2AFFCAEF38773B4B7D08725F10 
CDB93482FDCC54EDCEE91ECA4166B2A7C6265EF0CE2BD7051B7CEF945BABD47E 

6D 

FBD0013C674AA7 9CB39849527916CE301C66EA7CE8B80682786AD60F98F7E78 

19CA69EFF5C57400E3B3A0AD66CE0978214D13BAF4E9AC60752F7B155E2DE4D 

E3 


aP 
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979 Deterministic DSA and ECDSA 


y pair: 
rve: NIST K-163 


= 4000000000000000000020108A2E0CCOD99F8A5EF 


qlen = 163 bits) 


ivate key: 


= 09A4D6792295A7F730FC3F2B49CBCOF62E862272F 


blic key: U = xG 


79AEEO90DBO5EC252D5CB4452F356BE198A4FF96F 


782E29634DDC9A31EF40386E896BAA18B53AFA5DA3 
gnatures: 


th SHA-1, message = "sample": 

= 09744429FA741D12DE2BE8316E35E84DB9E5DF1CD 
= 30C45B80BA0E1406C4EFBBB7000D6DE4FA465D505 
= 38D87DF89493522FC4CD7DE1553BD9DBBA2123011 


th SHA-224, message = "sample": 

= 323E7B28BFD64E6082F5B12110AA87BCOD6A6E159 
38A2749F7EA13BD5DA0C76C842F512D5A65FFAF32 
= 064F841F70112B793FD773F5606BFAS5AC2A04C1E8 


th SHA-256, message = "sample": 

23AF4074C90A02B3FE61D286D5C87F425E6BDD81B 
= 113463990598A3828C407C0F4D2438D990DF99A7F 
1313A2E03F5412DDB296A22E2C455335545672D9F 


th SHA-384, message = "sample": 

= 2132ABE0ED518487D3E4FA7FD24F 8BEDIF2 9CCFCE 
34D4DE955871BB84FEA4E7D068BA5E9A11BD8B6C4 
= 2BAAF4D4FD57F175C405A2F39F9755D9045C820BD 


th SHA-512, message = "sample": 

= 00BBCC2F39939388FDFE841892537EC7B1FF33AA3 
38E487F218D696A7323B891F0CCF055D895B77ADC 
0972D7721093F9B3835A5EB7F0442FA8DCAA873C4 
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With SHA-1, message = "test": 

k 14CAB9192F39C8A0EA8E81B4B87574228C99CD681 
r = 1375BEF93F21582F601497036A7DC8014A99C2B79 
sS 254B7F1472FFFEE9002D081BB8CE819CCE6E687F9 


With SHA-224, message = "test": 

k 091DD986F38EB936BE053DD6ACE3419D2642ADE8D 
r = 110F17EF209957214E35E8C2E83CBE73B3BFDEE2C 
s 057D5022392D359851B95DEC2444012502A5349CB 


With SHA-256, message = "test": 

k = 193649CE51F0CFF0784CFC47628F4FA854A93F7A2 
r 0354D5CD24F9C41F85D02E856FA2B0001C83AF53E 
s 020B200677731CD4FE48612A92F72A19853A82B65 


With SHA-384, message = "test": 

k = 37C73C6F8B404EC83DA17A6EBCA724B3FF1F7EEBA 
r = 11B6A84206515495AD8DBB2E5785D6D018D75817E 
s = 1A7D4C1E17D4030A5D748ADEA785C77A54581F6D0 


With SHA-512, message = "test": 

k = 331AD98D3186F73967B1E0B120C80B1E22EFC2988 
r = 148934745B351F6367FF5BB56B1848A2F508902A9 
s 36214B19444FAB504DBA61D4D6FF2D2F9640F4837 


Pornin Informational [Page 43] 


RFC 6979 Deterministic DSA and ECDSA August 2013 


A.2.9. 


ECDSA, 233 Bits (Binary Field, Koblitz Curve) 


Key pair: 


curve: NIST K-233 


q = 
( 


8000000000000000000000000000069%D5BB915BCD46EFB1AD5F173ABDF 


qlen = 232 bits) 


private key: 


= 


103B2142BDC2A3C3B55080D09DF1808F79336DA2399F5CA7171D1BE9B0O 


public key: U = xG 


Ux = 0682886F36C68473C1A221720C2B12B9BE13458BA907E1C4736595779F2 

Uy = 1B20639B41BE0927090999B7817A3B3928D20503A39546044EC13A10309 

Signatures: 

With SHA-1, message = "sample": 

k = 273179E3E12C69591AD3DD9C7CCE3 985820E3913AB6696EB14486DDBCF 

r = 5474541C988A9A1F73899F55EF28963DFFBBFOC2B1A1EE787C6A76C6A4 

s = 46301F9EC6624257BFC70D72186F17898EDBD0A3522560A88DD1B7D45A 

With SHA-224, message = "sample": 

k = 71626A309D9CD80AD0B975D757FE6BF4B84E4 9F8F34C780070D7746F19 

r = 667F2FCE3E1C497EBD8E4B7C6372A8234003FE4ED6D4515814E7E11430 

s = 6A1C41340DAA730320DB9475F10E29A127D7AE3432F155E1F7954E1B57 

With SHA-256, message = "sample": 

k = 73552F9CAC5774F74F485FA253871F2109A0C86040552EAA67DBA92DC9 

r = 38AD9C1D2CB29906E7D63C24601AC55736B438FB14F4093D6C32F63A10 

s = 647AAD2599C21B6EE89BE7FF957D98F684B7921DE1FD3CC82C079624F4 

With SHA-384, message = "sample": 

k = 17D726A67539C609BD99E2 9AA3737EF247724B71455C3B6310034038C8 

r = 0C6510F57559C36FBCFF8C7BA4B81853DC 61 8AD0BAABO3CFFDF3FD09FD 

s = 0AD331EE1C9B91A88BA77997235769C60AD0 7EE69E11F7137E17C5CF67 

With SHA-512, message = "Sample": 

k = 0E535C328774CDE546BE3AF5D7FCD263872F107E807435105BA2FDC166 

r = 47C4AC1B344028CC740BA7BB9F 8AA5 9D6390E3158153D4F2ADE4B74950 

s = 26CE0CDE18A1B884B3EE1A879C13B42F11BB7C85F7A3745C8BECEC8E6E 
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With SHA-1, message = "test": 


k = 
r= 
Ss 


1D8BBF5CB6EFFA270A1CDC22C81E269F0CC16E27151E0A460BA9B51AFF 
4780B2DE4BAA5 613872179AD90664249842E8B96FCD5653B55DD63EED4 
6AF 46BA322E21D4A8 8DAEC1 650EF38774231276266D6A45ED6A64ECB44 


With SHA-224, message = "test": 


k = 
r= 
S 


67634D0ABA2C9BF7AE54846F26DCD166E7100654BCE6FDC96667631AA2 
61D9CC8C842DF19B3D9F4BDA0D0E14A957357ADABC239444610FB39AEA 
66432278891CB594BA8D08A0C556053D15917E53449E03C2EF88474CF6 


With SHA-256, message = "test": 


k = 
r= 
S 


2CE5AEDC155ACCODDC5E679EBACFD21308362E5EFC05C5E99B2557A8D7 
O5E4E6B4DB0E13034E7F1F2E5DBAB766D37C15AE4056C7EE607C8AC7F4 
5FC46AA489BF828B34FBAD25EC432190F161BEA8F60D3FCADBOEE3B725 


With SHA-384, message = "test": 


k 
r= 
s = 


1B4BD3903E74FD0B31E23F956C70062014DFEFEE21832032EA5352A055 
50F1EFEDFFEC1088024620280EE0D7641542E4D4B5D61DB32358FC571B 
4614EAE449927A9EB2FCC42EA3E955B43D194087719511A007EC9217A5 


With SHA-512, message = "test": 


k = 
r= 
S 


Pornin 


1775ED919CA491B5B014C5D5E86AF53578B5A7976378F192AF665CB705 
6FE6D0D3A953BB66BB01BC6B9EDFAD 9F35E88277E5768D1B214395320F 
7C01A236E4BFF0A771050AD01EC1D24025D3130BBD9E4E81978EB3EC09 
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ECDSA, 283 Bits (Binary Field, Koblitz Curve) 


Key pair: 


curve: NIST K-283 


q 


1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE9AE2ED07577265DFF7F94451E061 


El63C61 


(qlen = 281 bits) 


private key: 


x 


06A0777356E87B8 9BALED3A3D845357BE332173C8F7A65BDC7DB4FAB3C4CC79A 


CC8194E 


public key: U = xG 


Ux = 25330D0A651D5A20DC6389BC02345117725640AEC3C126612CE444EDD19649BD 
ECCO3D6 
Uy = 505BD60A4B67182474EC4D1C668A73140F70504A68F39EFCD972487E9530E050 
8A76193 
Signatures: 
With SHA-1, message = "sample": 
k = 0A96F788DECAF6C9DBE24DC75ABAGEAAE85E7AB003C8D4F83CB1540625B2993B 
F445692 
r = 1B66D1E33FBDB6E107A69B610995C93C744CEBAEAF623CB42737C27D60188BD1 
DO45A68 
s = 02E45B62C9C258643532FD536594B46C63B063946494F95DAFF8759FD5525023 
24295C5 
With SHA-224, message = "sample": 
k = 1B4C4E3B2F6B08B5991BD2BDDE277A7016DA527ADOAAE5BC61B64C5A0EE63E8B 
502EF61 
r = 018CF2F371BE86BB62E02B27CDE56DDAC83CCFBB3141FC59AEE022B66AC1A60D 
BBD8B76 
s = 1854E02A381295EA7F184CEE71AB7222D6974522D3B99B309B1A8025EB84118A 
28BF20E 
With SHA-256, message = "sample": 
k = 1CEB9E8E0DFF53CE687DEB81339ACA3C98E7A657D5A9499EF779F887A934408E 
CBE5A38 
r = 19E90AA3DE5FB20AED22879F92C6FED278D9C9B9293CC5E94922CD952C9DBF20 
DF1753A 
s = 135AA7443B6A25D11BB64AC482E04D47902D017752882BD72527114F46CF8BB5 
6C5A8C3 
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With SHA-384, message = "sample": 

k = 1460A5C41745A5763A9D548AE62F2C3630BBED71B6AA549D7F829C22442A728C 
5D965DA 

r = 0F8C1CA9C221AD9907A136F787D33BA56B0495A40E86E671C940FD767EDD75EB 
6001A49 

s = 1071A56915DEE89E22E511975AA09D00CDC4AA7F5054CBE83F5977EE6F8E1CC3 
1EC43FD 

With SHA-512, message = "sample": 

k = OOF3B59FCB5C1A01A1A2A001 9E98C244DFF61502D6E6B9C4E957EDDCEB258EF4 
DBEFO4A 

r = 1D0008CF4BA4A701BEF70771934C2A4A87386155A2354140E2ED52E18553C35B 
47D9E50 

s = 0D15F4FA1B7A4D41D9843578E22EF98773179103DC4FF0DD1F74A6B5642841B9 
1056F78 

With SHA-1, message = "test": 

k = 168B5F8C0881D4026C08AC58 94A2239D21 9FAIF4DA0600ADAA56D5A1781AF81F 
O8A726E 

r = 140932FA7307666A8CCB1E1A09656CC40F5932965841ABD5E8E43559D93CF231 
1B02767 

s = 16A2FD46DA497E5E739DED67F426308C45C2E16528BF2A17EB5D65964FD88B77 
OFBB9C6 

With SHA-224, message = "test": 

k = 045E13EA645CE01D9B25EA38C8A8A170E04C83BB7F231EE3152209FE10EC8B2E 
565536C 

r = 0E72AF7E39CD72EF21E61964D87C838F977485FA6A7E999000AFA97A381B2445 
FCEE541 

s = 1644FF7D848DA1A040F77515082C27C763B1B4BF332BCF5D08251C6B57D80631 
9778208 

With SHA-256, message = "test": 

k = 0B585A7A68F51089691D6EDE2B43FC4451F66C10E65F134B963D4CBD4EB844B0 
E1469A6 

r = 158FAEB2470B306C57764AFC8528174589008449E11DB8B36994B607A65956A5 
9715531 

s = 0521BC667CA1CA42B5 64 9E7 8A3D76823C678B7BB3CD5 8D2E93CD7 91D53043A6F 
83F1FD1 

With SHA-384, message = "test": 

k = 1E88738E14482A09EE16A73D490A7FE8739DF500039538D5C4B6C8D6D7F208D6 
CA56760 

r = 1CC4DC5479E0F34C4339631A45AA690580060BF0EB518184C983E0E618C3B93A 
AB14BBE 

s = 0284D72FF8AFA83DE364502CBA0494BB06D40AE08F9D9746E747EA87240E589B 
A0683B7 
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With SHA-512, message = "test": 

k = 00E5F24A223BD459653F682763C3BB322D4EE75DD89C63D4DC61518D543E7658 
5076BBA 

r = 1£E7912517C6899732E09756B1660F6B96635D638283DF9A8A11D30E008895D7F 
5C9CTE3 

s = 0887E75CBDOB7DD9DE30ED79BDB3D78E4F1121C5EAFF5946918F594F88D36364 
4789DA7 
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A.2.11. ECDSA, 409 Bits (Binary Field, Koblitz Curve) 


Key pair: 

curve: NIST K-409 

q = 7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE5F83B2D4EA20 
400EC4557D5ED3E3E7CA5B4B5C83B8E01E5FCF 

(qlen = 407 bits) 


private key: 


x = 29C16768F01D1B8A89FDA85E2EFD73A09558B92A178A2931F359E4D70AD853E5 
69CDAF16DAA569758FB4E73089E4525D8BBFCF 


public key: U = xG 


Ux = OCF923F523FE3 4A6E8 63D8BA45FB1FE6D784C8F219C41 4EEF 4DB8362DBBD3CA7 
1AEB28F568668D5D7A0093E2B84F6FAD759DB42 

Uy = 13B1C374D5132978A1B1123EBBE9A5C54D1A9D56BO9AFDB4ADE93CCD7C4D332E 
2916F7D4B9D1857 8EE3C2E2DE4D2ECEODE63549 

Signatures: 

With SHA-1, message = "sample": 


k = 7866E5247F9A3556F983C86E81EDA696AC8489DB40A2862F278603982D304F08 
B2B6E1E7848534BEAF1330D37A1CF84C7994C1 

r = 71192EE99EC7AFE23E02CB1F9850D1ECE620475EDA6B65D04984029408EC1E5A6 
476BC940D81F218FC31D979814CAC6E78340FA 

s = 1DE75DE97CBE740FC79A6B5B22BC2B7832C687E6960F0B8173D5D8BE2A75AC6C 
A43438BAF69C669CE6D64E0FB93BC5854E0F81 


With SHA-224, message = "sample": 

k = 512340DB682C7B8EBE407BF1AA54194DFE85D49025FE0F632C9B8A06A996F2FC 
DOD73C752FB0 9D23DB8FBE50605DC25DF0745C 

r = 41C8EDF39D5E4E76A04D24E6BFD4B2EC35F99CD2483478FD8B0A03E99379576E 
DACC4167590B7D9C387857A5130B1220CB771F 

s = 659652EEAC9747BCAD58034B25362B6AA61836E1BA50E2F37630813050D43457 
E62EABOF13AE197E6CFE0244F983107555E269 


With SHA-256, message = "sample": 

k 782385F18BAF5A36A588637A76DFAB0O5739A14163BF723A4417B74BD1469D37A 
C9E8CCE6AEC8FF 63F37B815AAF14A876EED 962 

r = 49EC220D6D24980693E6D33B191532EAB4C5D924E97E305E2C1CCFE6F 1LEAEF 96 
C17F6EC27D1E06191023615368628A7E0BD6A9 

s = 1A4AB1DD9BAAA21F77C503E1B39E770FFD44718349D54BA4CF08F688CE89D7D7 
C5F7213F225944BE5F7C9BA42B8BEE382F8AF9 
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With SHA-384, message = "sample": 

k 4DA637CB2E5C90E486744E45A73935DD698D4597E736DA332A06EDA8B26D5ABC 
6153EC2ECE14981CF3E5E023F36FFA55EEA6D7 

r = 562BB99EE027644EC04E4 93C5E81B41F261F6BD18FB2FAR3AFEAD91FAB8DD44A 
FA910B13B9C79C87555225219E44E72245BB7C 

s = 25BA5F28047DDDBDA7ED7E49DA31B62B20FD9C7E5B8988817BBF738B3F4DFDD2 
DCDO6EE6DF2A1B744C850DAF952C12B9A56774 


With SHA-512, message = "sample": 

k 57055B293ECFDFE983CEF716166091E573275C53906A39EADC25C89C5EC8D7A7 
E562 9FCFDFAD514E1348161C9A34EA1C42D58C 

r = 16C7E7FB33B5577F7CF6F77762F0F2D531C6E7A3528BD2CF582498C1A48F2007 
89E9DF7B754029DA0D7E3CE96A2DC760932606 

s = 272961 7EFBF80DA5D2F201AC7910D3404A992C39921C2F65F8CF4601392DFE93 
3E6457EAFDBD13DFE160D243100378B55C290A 


With SHA-1, message = "test": 

k 545453D8DC05D220F9A12EF322D0B855E664C72835FABE8A41211453EB8A7CFF 
950D80773839D0043A46852DDA5A536E02291F 

r = 565648A5BAD24E747A7D7531FA9DBDFCB184ECFEFDBO0O0A319459242B68D0989E 
52BED4107AED35C27D8ECA10E876ACA48006C9 

s = 7420BA6FF72ECC5C92B7CA0309258B5879F26393DB22753B9EC5DF905500A042 
28AC08880C485E2AC8834E13E8FA44FA57BF18 


With SHA-224, message = "test": 

k = 3C5352929D4EBE3CCE87A2DCE380F0D2B33C901E61ABC530DAF3506544AB0930 

AB9YBFD553E51FCDA44F06CD2F4 9E17E07DB519 

251DFE54EAEC8A781ADF8A623F7F3 6B4ABFC7EEOAE7 8C8406E93B5C3932A8120 

AB8DFC4 9D8E243C7C30CB5B1E021BADBDF 9CA4 

s = 77854C2E72EAA6924CCOB5F6751379D132569843B1C7885978DBBAA6678967F6 
43A50DBBO6E6EA6102FFAB7766A57C3887BD22 


K 
ll 


With SHA-256, message = "test": 

k 251E32DEE1 0ED5EA4AD7370DF3EFF091E467D5531CA5 9DE3AA7 91763715E1169 
AB5E18C2A11CD473B0044FB45308E8542F2EBO 
58075FF7E8D36844EEDOFC3F78B7CFFDEEF 6ADE5 982D5636552A081923E24841 
C9E37DF2C8C4BF2F2F7A174927F3B7E6A0BEB2 
0A737469D013A31B91E781CE201100FDE1FA48 8ABF2252C025C678462D715AD3 
078C9D049E06555CABDF37878CFB909553FF51 


K 
ll 


n 
ll 


With SHA-384, message = "test": 

k 11C540EA46C5038FE28BB66E2E9E9A04C9FE9567ADF33D56745953D44C1DC8B5 
B92922F53A174E431C0ED8267D919329F19014 

r = 1C5C88642EA216682244E46E24B7CE9AAEF9B3F97E585577D158C3CBC3C59825 
0A53F6D46DFB1E2DD9DC302E7DA4FOCAAFF291 

s = 1D3FD721C35872C74514359F88AD983E170E5DE5B31AFCOBE12E9F4AB2B2538C 
7797686BA955C1D042FD1F8CDC482775579F11 
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With SHA-512, message = "test": 


k = 
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59527CE953BC09DF5E85155CAE7BB1D7F342265F41635545B06044F844ECB4FA 
6476E7D47420ADC8041E75460EC0A4EC760E95 
1A32CD776414 9DF7 934 9DBF79451F4585BB4 90BD63A200700D7111B45DDA4140 
00AE1B0A69ARACBA1364DD7719968AAD123F93 
582AB1076CAFAE23A76244B82341AEFC4C6D8D8060A62A352C33187720C8A37F 
3DAC227E62758B11DF1562FD249941C1679F82 
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A.2.12. ECDSA, 571 Bits (Binary Field, Koblitz Curve) 
Key pair: 
curve: NIST K-571 
a = 2000000000000000000000000000000000000000000000000000000000000000 
0000000131850E1F19A63E4B391A8DB917F4138B630D84BE5D639381E91DEB45 
CFE778F637C1001 
(qlen = 570 bits) 


private key: 


x = 0C16F58550D824ED7B95569D4445375D3A490BC7E0194C41A39DEB732C29396C 
DF1D66DE02DD1460A816606F 3BECOF32202C7BD18A32D87506466AA92032F131 
4ED7B19762B0D22 


public key: U = xG 


Ux = 6CFB0DF7541CDD4C41EF319EA88E849EFC8605D97779148082EC991C463ED323 
19596F 9FDF4779C17CAF20EFD9BEB57E9F 4ED55BFC52A2FA15CA23BC62B7BF01 
9DB59793DD77318 


Uy = 1CFC91102F7759A561BD8D5B51AAAEECTF40E659D67870361990D6DE29F6B4F7 
E18AE13BDE5EA5C1F77B23D676F44050C 9DBFCCDD7B3756328DDA05977 9AAE84 
46FC5158A75C227 


Signatures: 


With SHA-1, message = "sample": 

k = 17F7E360B21BEAE4A757A19ACA77FB404D273F05719A86EAD9D7B3F4D5ED7B46 
30584BB153CF7DCD5A87CCA101BD7EA9ECAOCEDEE27CA985833560000BB52B6B 
BE068740A45B267 

r = 0767913F96C82E38B7146A505938B79EC07E9AA3214377651BE968B52C039D3E 
483 7B4A2DE2 6C481C4E1DE96F 4D 9DE63845D9B32E26D0D332725678E3CE57F66 
8A5E3108FB6CEA5 

s = 109F89F55FA39FF465E40EBCF869A9B1DB425AEA53AB4ECBCE3C310572F79315 
F5D4891461372A0C36E63871BEDDBB3BA2042C6410B67311F1A185589FF4C987 
DBAO2F 9D992B9DF 
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With SHA-224, message = "sample": 

k = 0B599D068A1A00498EE0B9AD6F388521F594BD3F234E47F7A1DB6490D7B57D60 
B0101B36F39CC22885F78641C69411279706F0989E6991E5D5B53619E43EFB39 
7E25E0814EF02BC 

r = 010774B9F14DE6C9525131AD61531FA30987170D43782E9FB84FF0D70F093946 
DF75ECB69D400FE39B12D58C67C19DCE96335CEC1D9AADE0O04FE5B498AB8A940 
D46C8444348686A 

s = O6DFE9AASFEA6CF2CEDCO6EE1F9FD9853D411F0B958F1C9C519C90A85F6D24C1 
C3435B3CDF4E207B4A67467C87B7543F6C0948DD382D24D1E48B3763EC27D4D3 
2A0151C240CC5E0 


With SHA-256, message = "sample": 

k = OF79D53E63D8 9FB87F 4D 9E6DC5 94 9F5D938 8BCFE9YEBCB4C2F7CE497814CF40E8 
45705F8F18DBF0F860DE0B1CC4A433EF74A5741F3202E958C082E0B76E16ECD5 
866AA0F5F3DF300 

r = 1604BE98D1A27CEC2D3FA4BD07B42799E07743071E4 905D7DCE7F6992B21A27F 
14F55DOFE5A7810DF65CF07F2F2554658817E5A88D952282EA1B8310514C0B40 
FFF46F159965168 

s = 18249377C654B8588475510F7B797081F68C2F8CCCE49F730353B2DA3364B1CD 
3E984813E11BB791824038EA367BA74583AB97A69AF2D77FAG91AA694E348E15 
DA76F5A44EC1F40 


With SHA-384, message = "sample": 

k = 0308253C022D25F8A9EBCD24459DD6596590BDEC7895618EEE8A2623A98D2A2B 
2E7594EE6B7AD3A39D70D68CB4ED01CB28E2129F8E2CC0CC8DC7780657E28BCD 
655FOBE9B7D35A2 

r = 1E6D7FB237040EA1904CCBF0984B81B866DE10D8AA93B06364C4A46F6C9573FA 
288C8BDDCCOC6B984E6AA75B42E7BF82FF34D51DFFBD7C87FDBFAD971656185B 
D12E4B8372F4BF1 

s = 04F94550072ADA7E8C82B7E83577DD39959577799CDABCEA60E267F36F1BEB98 
LABF24E722A7F031582D2CC5D80DAA7CODEEBBE1LAC5E72 9A6DBB34A5D645B698 
719FCA40 9FBA370 


With SHA-512, message = "sample": 

k = OC5EE7070AF55F84EBC43A0D481458CEDE1DCEBB57720A3C92F59B4941A044FE 
CFF4F703940F3121773595E880333772ACF822F2449E17C64DA286BCD65711DD 
5DA44D7155BF004 

r = 086C9E048EADD7D3D2 90850108 6F 3AF 44 9A0 1 AF 6BEB2026DC381B39530BCDDB 
8E854251CBD5C31E6976553813C11213E4761CB8CA2E5352240AD9FB9C635D55 
FAB13AE42E4EE4F 

s = O9FEE0OA68F322B380217FCF6ABFF15D78C432BD8DD82E18B6BA877C01C860E24 
410F5150A44F979920147826219766ECB4E2E11A151B6A15BB8E2E825AC95BCC 
A228D8A1C9D3568 


Gl 
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With SHA-1, message = "test": 


k = 


1D056563469E933E4BE064585D84602D430983BFBFD6885A94BA4 8 4DF 9A7AB03 
1AD6AC090A433D8EEDCOA7 64 3EA2A9BC3B62 9 9E8ABA933B4C1F2652BB4 9DAEE8 
33155C8F1319908 

1D055F499A3F7E3FC73D6E7D517B470879BDCB14ABC938369F23643C7B96D024 
2C1FF326FDAF1CCC8593612ACE982209658E73C24C9EC493B785608669DA74A5 
B7C9A1D8EA843BC 
1621376C53CFE3390A0520D2C657B1FFOEBB10E4B9C2510EDC39D04FEBAF12B8 
502B098A8B8F842EA6E8EB9D55CFEF 94B7FF6D145AC3FFCE71BD978FEA3EF 819 
4D4AB52 93A8F3EA 


With SHA-224, message = "test": 


k = 


1DA875065B9D94DBE75C61848D69578BCC267935792624F9887B53C9AF9E43CA 
BFC42E4C3F9A456BA89E717D24F1412F33CFD297A7A4D403B18B5438654C74D5 
92D5022125E0C6B 
18709BDE4E9B73D046CE0D48842C97063DA54DCCA28DCB087168FA37DA2BF5FD 
BE4720EE48D49EDE4DD5BD31AC0149DB8297BD410F9BCO02A11EB79B60C8EE63A 
F51B65267D71881 
12D8B9E98FBF1D264D78669E236319D8FFD8426C56AFB10C76471EE88D7FOAB1 
B158E685B6D93C850D47FB1D02E4B24527473DB60B8D1AEF26CEEBD3467B65A7 
OFFDDCODBB64D5F 


With SHA-256, message = "test": 


k = 


04DDD0707E81BB56EA2D1D45D7FAFDBDD56912CAE224086802FEA1018DB306C4 
FB8D93338DBF6841CE6C6AB1506E9A848D2C0463E0889268843DEE4ACB552CEFF 
CB858784ED116B2 

1F5BF6B044048E0E310309FFDAC825290A69634A0D3592DBEE7BE71F69E45412 
F766AC92E174CC99AABAA5C9C8 9FCB187DFDBCC7A26765DB6D9F1EEC8A6127BB 
DFA5801E44E3BEC 
1B44CBFB233BFA2A98D5E8B2F0B2C27F 94 94BEAA7 7FEB5 9CDE3E7AE9CB2E385B 
E8DA7B80D7944AA71E0654E5067E9A70E88E68833054EED49F28283F02B22912 
3995AF37A6089F0 


With SHA-384, message = "test": 


k = 


K 
ll 
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0141B53DC6E569D8C0C0718A58A5714204502FDA146E7E2133E56D19E905B794 
13457437095DE13CF68B5CF5C54A1F2E198A55D974FC3E507AFCOACF95ED391C 
93CC79E3B3FE37C 
11F61A6EFAB6D83053D9C52665B3542FF3F63BD5913E527BDBAO7FBAF34BC766 
C2EC83163C5273243AA834C75FDDD1BC8A2BEAD388CD06C4EBA1962D645EEB35 
E92D44E8F2E081D 
16BF6341876F051DF224770CC8BA0E4D48B3332568A2B014BC80827BAA89DE18 
D1AEBC73E3BE8F85A8008C682AAC7D5FOE9FB5ECBEFBB637E30E4A0F226D2C2A 
A3E569BB54AB72B 
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With SHA-512, message = "test": 

k = 14842F97F263587A164B215DD0F912C588A88DC4AB6AF4C530ADC1226F16E086 
D62C14435E6BFAB5 6F019886C88922D2321914EE41A8F7 4 6AAA2B964822E4AC6 
F40EE2492B66824 

r = 0F1E50353A39EA64CDF23081D6BB4B2A91DD73E99D3DD5A1AA1C49B4F6E34A66 
5EAD24FD530B9103D522609A395AF3EF174C85206F67EF84835ED1632E0F6BAB 
718EA90DF 9E2DA0 

s = 0B385004D7596625028E3FDE72282DE4EDC5B4CE33C1127F21CC37527C90B730 
7AE7D09281B840AEBCECAA711B00718103DDB32B3E9F6A9FBC6AF23E224A73B9 
435F619D9C62527 
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A.2.13 


ECDSA, 163 Bits (Binary Field, Pseudorandom Curve) 


Key pair: 


curve: NIST B-163 


q = 
( 


40000000000000000000292FE77E70C12A4234C33 


alen = 163 bits) 


private key: 


x= 


35318FC447D48D7E6BC93B48617DDDEDF26AA658F 


public key: U = xG 


Ux = 126CF562D95A1D77D387BA75A3EA3A1407F23425A 
Uy = 7D7CB5273C94DA8CA9304 9AFDA18721C24672BD71 
Signatures: 
With SHA-1, message = "sample": 
k = 0707A94C3D352E0A9FE49FB12F264992152A20004 
r = 153FEBD179A69B6122DEBF5BC61EB947B24C93526 
s = 37AC9C670F8CF18045049BAE7DD35553545C19E49 
With SHA-224, message = "sample": 
k = 3B24C5E2C2D935314EABF57A648428 9B2 91 ADFE3F 
r = 0A379E69C44F9C16EA3215EA39EB1A9B5D58CC955 
s = 04BAFF5308DA2A7FE2C1742769265AD3ED1D24E74 
With SHA-256, message = "sample": 
k = 3D7086A59E6981064A9CDB684653F3A81B6ECOFOB 
r = 134E00F78FC1CB9501675D91C401DE20DDF228CDC 
s = 373273AEC6C36CB7BAFBB1903A5F5EA6A1D50B624 
With SHA-384, message = "sample": 
k = 3B1E4443443486C7251A68EF184A936F05F8B17C7 
r = 29430B935AF8E77519B0CA4F6903B0B82E6A21A66 
s = 1£A1415306E9353FA5AA54BC7C2581DFBB888440D 
With SHA-512, message = "Sample": 
k = 2EDF5CFCAC7553C17421FDF54AD1D2EF928A879D2 
r = 0B2F177A99F9DF2D51CCAF55F015F326E4B65E7A0 
s = 0DF1FB4487E9B120C5E970EFE48F55E406306C3A1 
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With SHA-1, message = "test": 

k = 10024F5B324CBC8954BA6ADB320CD3AB9296983B4 
r = 256D4079C6C7169B8BC92529D701776A269D56308 
sS 341D3FFEC9F1EB6A6ACBE8 8E3C8 6A1C8FDEB8B8E1 


With SHA-224, message = "test": 

k = 34F46DE59606D56C75406BFB459537A7CC280AA62 
r = 28ECC6F1272CE80EA59DCF32F7AC2D861BA803393 
s 0AD4AE2C06E60183C1567D2B82F19421FE3053CE2 


With SHA-256, message = "test": 

k = 38145E3FFCA94E4DDACC20AD6E0997BD0E3B669D2 
YE 227DF377B3FA50F90C1CB3CDCBBDBA552C1D35104 
s 1F7BEAD92583FE920D353F368C1960D0E88B46A56 


With SHA-384, message = "test": 

k = 375813210ECE9C4D7AB42DDC3C55F89189CF6DFFD 
r = 11811DAFEEA441845B6118A0DFEE8A0061231337D 
s = 362583018 65EE48C5C6F91D63F62695002AB55B57 


With SHA-512, message = "test": 

k = 25AD8B393BC1E9363600FDA1A2AB6DF40079179A3 
r = 3B6BB95CA823BE2ED8E3972FF516EB8972D765571 
s 13DC6F420628969DF900C3FCC48220B38BE24A541 
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A.2.14. ECDSA, 233 Bits (Binary Field, Pseudorandom Curve) 
Key pair: 
curve: NIST B-233 


a = 1000000000000000000000000000013E974E72F8A6922031D2603CFE0D7 
(qlen = 233 bits) 


private key: 


x = 07ADC13DD5BF34D1DDEEB50B2CE23B5F5E6D18067306D60C5F6FF11E5D3 


public key: U = xG 


Ux OFB348B3246B473AA7FBB2A01B78D61B62C4221D0F 9AB55FC72DB3DF478 


Uy 1162FA1F 6C6ACF7FD8D1 9FC7D74BDD9104076E833898BC4C042A6E6BEBF 


Signatures: 


With SHA-1, message = "sample": 

k = 0A4E0B67A3A081C1B35D7BECEB5FE72A918B422B907145DB5416ED751CE 
E 015CC6FD78BBO6E0878E71465515EA5A21A2C18E6FC77B4B158DBEB3 944 
s 0822A4A6C2EB2DF213A5E90BF40377956365EE8C4B4A5A4E2EB9270CB6A 


With SHA-224, message = "sample": 

k = 0F2B1C1E80BEB58283AAA79857F"77B83BDF724120D0913606FDO7F7FFB2C 
r = 05D9920B53471148E10502AB49AB7A3F11084820A074FD89883CF51BC1A 
s = 04D3938900C0A9AAA7080D1DFEB56CFBOFADABE4214536C7ED5117ED13A 


With SHA-256, message = "sample": 

k = 034A53897B0BBDB484302E19BF3F9B34A2ABFED639D109A388DC52006B5 
r = 0A797F3B8AEFCE7456202DF1E46CCC291EA5A49DA3D4BDDA9A4B62D5E0D 
s 01F6F81DA55C22DA4152134C661588F4BD6F82FDBAF0C5877096B070DC2 


With SHA-384, message = "sample": 

k = 04D4670B28990BC92EEB49840B482A1FA03FE028D09F3D21F89C67ECA85 
r = 015F85A8D46225DD7E314A1C4289731FC14DECE94 934 9FE535D11043B85 
s = 03F189D37F50493EFD5111A129443A662AB3C6B28 912 9AD8COCAC85119C 


With SHA-512, message = "sample": 

k = ODE108AAADA760A14F42C057EF81C0A31AF6B82E8FBCA8DC86E443AB549 
r = 03B62A4BF783919098B1E42F496E£E65F7621F01D1D466C46940F0F132A95 
sS OF4BE031C6E5239E7DAA014CBBF1ED19425E49DAEB426EC9DF4C28A2E30 
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With SHA-1, message = "test": 

k 0250C5C90A4E2A3F8849FEBA87F0DOAE630AB18CBABB84F4FFFB36CEACO 
E 02F1FEDC57BE203E4C8C6B8C1CEB35E13C1FCD956AB41E3BD4C8AG6EFB1F 
s 05738EC8A8EDEA8E435EE7266AD3EDE1EEFC2CEBE2BE1D614008D5D2951 


With SHA-224, message = "test": 

k = O7BDB6A7FDO80D9EC2FC84BFF9E3E15750789DC04290C84FEDOOE109BBD 
r = 0CCE175124D3586BA7486F71468 94C65C2A4A5A1 904658E5C7F IDF 5FA5D 
s 08804B456D847ACE5CA8 6D97BF7 9FD6335E5B17F6COD964B5D0036C867E 


With SHA-256, message = "test": 

k = 00376886E89013F7FF4B5214D56A30D49C99F53F211A3AFE01AA2BDE12D 
r = 035C3D6DFEEA1CFB29B93BE3FDB91A7B130951770C2690C16833A159677 
s 0600F7301D12AB376B56D4459774159ADB51F97E282FF384406AFD53A02 


With SHA-384, message = "test": 

k 03726870DE75613C5E529E453F4D92631C03D08A7F63813E497D4CB3877 
r = 061602FC8068BFD5FB86027B97455D200EC603057446CCE4D76DB8EF42C 
s = 03396DD0D59C067BB999B422D9883736CF9311DFD6951F91033BD03CA8D 


With SHA-512, message = "test": 

k = 09CE5810F1AC68810BODFFBB6BEEF2E0053BB937969AE7886F9D064A8C4 
r = 07E12CB60FDD614958E8E34B3C12DDFF35D85A9C5800E31EA2CC2EF63B1 
s 0E8970FD99D836F3CC1C8074A42C58760DE6EDAA23705A82B9CB1CE93FECC 
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A.2.15. ECDSA, 283 Bits (Binary Field, Pseudorandom Curve) 
Key pair: 
curve: NIST B-283 
q = 3FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEF90399660FC938A90165B042A7CE 
FADB307 
(qlen = 282 bits) 


private key: 


x = 14510D4BC44F2D26F4553942C98073C1BD35545CEABB5CC138853C5158D2729E 
A408836 


public key: U = xG 


Ux = 17E3409A13C399F0CA8A1 92F028D46E3446BCFFCDF51FF8A905ED2DED78 6E74F 
9C3E8A9 
Uy = 47EFCBCC31C01D86D1992F7BFACO277DBD02A6D289274099A2C0F039C8F59F31 
8371B0E 

Signatures: 

With SHA-1, message = "sample": 

k = 277F389559667E8AE4B65DC056F8CE2872E1917E7CC59D17D485B0B98343206F 
BCCD441 

r = 201E18D48C6DB3D5D097C4DCE1E25587E1501FC3CF47BDB5B4289D79E273D6A9 
ACB8285 

s = 151AE05712B024CE617358260774C8CA8BOE7A7E72EF 822 9BF 2ACE7609560CB3 
0322C4F 

With SHA-224, message = "sample": 

k = 14CC8FCFEECD6B999B4DC6084EBBO6FDEDOB44D5C507802CC7A5E9ECF36E69DA 
6AE23C6 

r = 143E878DDFD4DF40D97B8CD638B3C4706501C2201CF7108F2FB91478C11D6947 
3246925 

s = OCBF1B9717FEEA3AABBO9D9654110144267098E0E1E8D0289A6211BE0OEEDFDD8 
6A3DB79 

With SHA-256, message = "Sample": 

k = 38C9D662188982943E080B794A4CFB0732DBA37C6F40D5B8CFADED6FF31C5452 
BA3F877 

r = 29FD82497FB3E5CEF65579272138DE59E2B666B8689466572B3B69A172CEE83B 
E145659 

s = 05A89D9166B40795AF0FE5958201B9C0523E500013CA12B4840EA2BC53F25F9B 
3CE87C0 
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With SHA-384, message = "sample": 

k = 21B7265DEBF90E6F988CFFDB62B121A02105226C652807CC324ED6FB119A287A 
72680AB 

r = 2F00689C1BFCD2A8C7A41E0DE55AE182E6463A152828EF89FE3525139B660329 
4E69353 

s = 1744514FE0A37447250C8A329%EAAADA81572226CABA16F39270EE5DD03F27B1F 
665EB5D 

With SHA-512, message = "sample": 

k = 20583259DC179D9DA8E5387E89BFF2A3090788CF1496BCABFE7D45BB120B0C81 
1EB8980 

r = ODA43A9ADFAA6AD767998A054C6A8F1CF77A562924628D73C62761847AD8286E 
0D91B47 

s = 1D118733AE2C88357827CAFC6F68ABC25C80C640532925E95CFE66D40F8792F3 
AC44C42 

With SHA-1, message = "test": 

k = 0185C57A743D5BA06193CE2AA47B07EF3D6067E5AE1A6469BCD3FC510128BA56 
4409D82 

r = 05A408133919F2CDCDBE5E4C14FBC706C1F71BADAFEF41F5DE4EC27272FC1CA9 
366FBB2 

s = 012966272872C097FEA7BCE64FAB1A81 982A773E2 6F 6E4EF7C99969846E67CA9 
CBE1692 

With SHA-224, message = "test": 

k = 2E5C1F00677A0E015EC3F799FA9E9A00430 9DBD78 464 0EAAF 5E1CE64D3045B9F 
E9C1FA1 

r = 08F3824E40C16FF1DDA8DC992776D26F4A5981AB5092956C4FDBB4F1AE0A711E 
EAA10E5 

s = 0A64B91EFADB213E11483FB61C73E3EF63D3B44EEFC56EA401B99DCC60CC28E9 
9FOF1FA 

With SHA-256, message = "test": 

k = 018A7D44F2B4341FEFE68F6BD8894960F97E£08124AAB92C1FFBBE90450FCC935 
6C9AAA5 

r = 3597B406F5329D11A79E887847E5EC60861CCBB19EC61F252DB7BD549C699951 
C182796 

s = 0A6A100B997BC622D91701D9F5C6F6D3815517E577622DA69D3A0E8917C1CBE6 
3ACD345 

With SHA-384, message = "test": 

k = 3C75397BA4CF1B931877076AF29F2E2F4231B117AB4B8E039F7F9704DE1BD352 
2F150B6 

r = 1BB490926E5A1FDC7C5AA86D0835F9B994EDA315CA408002AF54A298728D422E 
BF59E4C 

s = 36C682CFC9E2C89A782BFD3A191609D1F0C1910D5FD6981442070393159D65FB 
CCOABBA 
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With SHA-512, message = "test": 

k = 14E66B18441FA54C21E3492D0611D2B48E19DE3108D915FD5CA08E786327A267 
5F11074 

r = 19944AA68F9778C2E3D6E240947613E6DA60EFCE9B9B2C063FF5466D72745B5A 
OB25BA2 

s = 03F1567B3C5B02DF15C874F0EE22850824693D5ADC4663BAA19E384E550B1DD4 
1F31EE6 


Pornin Informational [Page 62] 


RFC 6979 Deterministic DSA and ECDSA August 2013 


A.2.16. ECDSA, 409 Bits (Binary Field, Pseudorandom Curve) 
Key pair: 
curve: NIST B-409 
a = 10000000000000000000000000000000000000000000000000001E2AAD6A612F 
33307BE5FA47C3C9E052F838164CD37D9A21173 
(qlen = 409 bits) 


private key: 


x = 0494994CC325B08E7B4CE038BD9436F90B5E59A2C13C3140CD3AE07C04A01FC4 
89F572CE0569A6DB7B8060393DE76330C624177 


public key: U = xG 


Ux = 1A7055961CF1DA4B9A015B18B1524EFO01FDD9B93FAEFC26FB1F2F828A7227B70 
31925DA0AC1A8A075C3B33554B222EA859C17E7 

Uy = 18105C042F290736088F30AEC7AE7732A45DE47BCE0940113AB8132516D1E059 
BOF581FD581A9A3CB3A0AC42A1 96273 8ADB8 6E6 

Signatures: 

With SHA-1, message = "sample": 


k = 042D8A2B34402757EB2CCFDDC3E6E96A7ADD3FDA547FC10A0CB77CFC720B4F 9B 
1 6EEAAA2ZA8CC4E4A4B5DBF7D8AC4EA4 9185960 

r = 0D8783188E1A540E2022D38 9E1D35B32F56F8C2BB5636B8ABF7718806B27A713 
EBAE37F63ECD4B61445CEF5801B62594EF3E982 

s = 03A6B4A80E204DB0DE12E7415C13C9EC091C52935658316B4A0C591216A38791 
54BEB1712560E346E7EF26517707435B55C3141 


With SHA-224, message = "sample": 

k = 0C933F1DC4C70838C2AD16564715ACAF545BCDD8DC203D25AF3EC63949C65CB2 
E68AC1F60CA7EACA2A823F4E240927AA82CEEC5 

r = OEE4F39ACC2E03CE96C3D 9FCBAFA5C22C8 9053662F8D4117752A9B10F09ADFDA 
59DB061E247FE5321D6B170EE758ACE1BE4D157 

s = 00A2B83265B456A430A8BF27DCC8A948 8B3F126C10F0D6D64BF7B8A218FAAF20 
E51A295A3AE78F205E5A4A6AE224C3639F1BB34 


With SHA-256, message = "sample": 

k 08EC42D13A3909A20C41BEBD2DFED8CACCE56C7A7D1251DF43F3E9E289DAE00E 
239F6960924AC451E125B784CB687C7F23283FD 

r = 02D8B1B31E33E74D7EB4 6C30FDE5AD2CA04EC8FEO 8FBAOE7 3BA5E5 68 953AC5EA 
307C072942238DFC07F4A4D7C7C6A9F86436D17 

s = 079F7D471E6CB73234AF7F"7C381D2CE15DE35BAF8BB68393B73235B3A26EC2DF 
4842CE433FB4 92D6E074E604D4870024D42189A 
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With SHA-384, message = "sample": 

k = 0DA881BCE3BA851485879EF8AC585A63F1540B9198ECB8A1096D70CB25A104E2 
F8A96B108AE76CB49CF34491ABC70E9D2AAD450 

r = 07BC638B7E7CE6FEE5SE9C64A0F 966D722D01BB4BC3F3A35F30D4CDDA92DFC5F7 
FOB4BBFE8065D9AD452FD77A1914BE3A2440C18 

s = 06D904429850521B28A32CBF55C7COFDF35DC4E0BDA2552C7BF68A171E970E67 
88ACCOB9521EACB4796E057C70DD9BI5FED5BFB 


With SHA-512, message = "Sample": 

k = 0750926FFAD7FF5DE85DF7960B3A4F 9F3D3 8CF5A04 9BFC89739C48D42B34FBEE 
03D2C047025134CC3145B60AFD22A68DFOA7FB2 

r = 05D178DECAFD2D02A3DA0D8BA1C4C1D95EE083C760DF782193A9F 7B4A8BE6FC5 
C21FD60613BCA65C063A61226E050A680B3ABD4 

s = 013B7581E98F6A63FBBCB3E49BCDA60F816DB230B888506D105DC229600497C3 
B46588C784BE3AA9343BEF82F7C9C80AEB63C3B 


With SHA-1, message = "test": 

k 017E£E167EAB1850A3B38EE66BFE2270F2F6BFDAC5E2D227D47B20E75F0719161E 
6C74E9F23088F0C58B1E63BC6F185AD2EF4EAE6 

r = 049F54E7C10D2732B4638473053782C6919218BBEFCEC8B51640FC193E832291 
FO5FA12371E9B448417B3290193F08EE9319195 

s = 0499E267DEC84E02F6F108B10E82172C414F15B1B7364BE8BFD66ADCOC5DE23F 
EE3DF0D811134C25AFE0E05A6672F98889F28F1 


With SHA-224, message = "test": 

k = 01ADEB94C19951B460A146B8275D81638C07735B38A525D76023AAF26AA8A058 
590E1D5B1E78AB3C91608BDA67CFFBE6FC8A6CC 

r = 0B1527FFAA7DD7C7E46B628587A5BEC0539A2D04D3CF27C54841C2544E1BBDB4 
2FDBDAAF8671A4CA8 6DFD61 9B1E3732D7BB56F2 

s = 0442C68C044868DF4832C807F1EDDEBF7F5052A64B826FD03451440794063F52 
B022DF304F47403D4069234CA9EB4C964B37C02 


With SHA-256, message = "test": 
k = O6EBA3D58D0E0DFC406D67FC72EF0C943624CF40019D1E48C3B54CCABO594AFD 
5DEE30AEBAA22E693DBCFECAD1A85D774313DAD 
r = 0BB27755B991D6D31757BCBF68CB01225A38E1CFA20F775E861055DD108ED7EA 
455E4B9 6B2F 6F 7CD6C6EC2B3C70C3EDDEB9743B 
0C5BE90980E7F444B5F7A12C9E9AC7A04CA81412822DD5AD1BE7C45D5032555E 
A070864245CF69266871FEB8CD1B7EDC30EF6D5 


n 
ll 


With SHA-384, message = "test": 

k = 0A45B787DB44C06DEAB8 46511 EEDBF7BFCFD3BD2C11D965C92FC1 95F67328F36 
A2DC83C0352885DAB9 6B55BO02FCF4 9DCCBOE2DA 

r = 04EFEB7098772187907C87B33E0FBBA4584226C50C11E98CA7AAC6986F8D3BEO 
44E5B52D201A410B852536527724CA5F8CE65409 

s = 09574102FEB3EF87E6D66B94119F5A6062950FF4F902EA1E6BD9E2037F33FF99 
1E31F5956C23AFE48FCDC557FD6F088C7C9B2B3 
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With SHA-512, message = "test": 


k= 


Pornin 


OB90F8A0E757E81D4EA6891766729C96A6D01 


A4F01C33555FF08530A5098CADB6EDAEZ2 68AB 


07E0249C68536AE2AEC2EC30090340DA49E6D 


ECDSA August 2013 


F9AEDCOD334932D1F81CC4E1973 
B5 
C9E9EEC8F85E5AABFB234B6DA7D 


2E9524028CF821F21C6019770474CC40BO1FA 
08125B5A03FB44AE81EA46D446130C2A415EC 
2DFA4E28C50FA8137F 9COC6CEE4CD3 7ABCCF6 


Informational 


F6 
CA265910CA69D55F2453E16CD7B 
D8 
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A.2.17. ECDSA, 571 Bits (Binary Field, Pseudorandom Curve) 

Key pair: 

curve: NIST B-571 

q = 3FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 
FFFFFFFE661CE18FF55987308059B186823851EC7DD9CA1161DE93D5174D66E8 
382E9BB2FE84E47 

(qlen = 570 bits) 

private key: 

x = 028A04857F24C1CO82DF0D90 9COE72F453F2E2340CCBO71F0E38 9BCA2575DA19 


124198C5717492 9AD2 6E34 8CF63F78D28021EF 5A9BF 2D5CBEAF 6B7CCB6C4DA82 
4DD5C82CFB24E11 


public key: U = xG 


Ux = 4B4B3CE9377550140B62C1061763AA524814DDCEF37B00CD5CDE94F7792BB0E9 
6758E55DA2E 9FEA8FF2A8B6830AE1D57A9CA7A77FCB083 6BF43EA5454CDD9FEA 
D5CCFE7375C6A83 


Uy = 4453B18F261E7A0E7570CD72F235EA750438E43946FBEBD2518B696954767AA7 
849C1719E18E1C51652C28CA853426F15C09AA4B579487338ABC7F33768FADD6 
1B5A3A6443A8189 


Signatures: 


With SHA-1, message = "sample": 

k = 2669FAFEF848AF67D437D4A151C3C5D3F 9AA8BB6 6EDC35F090C9118F95BA0041 
BO993BE2EF55DAAF36B5B3A737C40DB1F6E3D93D97B8419AD6E1BB8A5D4A0E9B 
2E76832D4E7B862 

r = 147D3EBOEDA9F2152DFD014363D6A9CE816D7A1467D326A625FC4AB0C786E1B7 
4DDF7CD4D0E99541391B266C704BB6B6E8DCCD27B460802E0867143727AA4155 
55454321EFE5CB6 

s = 17319571CAF533D90D2E78A64060B9C53169AB7FC908947B3EDADC54C79CCFOA 
7920B4C64A4EAB6282AFE9A459677CDA37FD6DD50BEF18709590FE18B923BDF7 
4A66B189A850819 
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With SHA-224, message = "sample": 


k = 


2EAFAD4AC8 64 4DEB2 90 95BBAA8 8D19F31316434F1766AD4423E0B54DD2FE0C05 
E307758581BODAED2 902683BBC7C47B00E63E3E42 9BA5 4EA6BA3AEC3 3A94C9A2 
4A6EF8E27B7677A 
10F4B63E79B2E54E4F4F6A2DBC786D8F4A143ECA7B2AD97810F6472AC6AE2085 
3222854553BE1D44A7974599DB7061AE8560DF57F2675BE5F9DD94ABAF3D47F1 
582B318E459748B 
3BBEA07C6B269C2B7FE9AE4DDB118338D0C2F0022920A7F9DCFCB7489594C03B 
536A9900C4EA6A10410007222D3DAE1A96F291C4C9275D75D98EB290DCOEEF17 
6037B2C7A7A3 9A3 


With SHA-256, message = "sample": 


k = 


15C2C6B7D1A070274484774E558B69FDFA193BDB7A23F27C2CD24298CE1B22A6 
CC9B7FB8CABFD6CF7C6B1CF3251E5A1CDDD1 6FBFED2 8DE7 9935BB2C631B8B8EA 
9CC4BCC937E669E 
213EF 9F 3BOCFC4BF 99 6B8AF 3A7E1F 6CACD2B87C8C63820000800AC787F17ECI9 
CO4BCEDF29A8413CFF83142BB8 8A50EF 8D 9A0 8 6AF 4EB03E97C567500C21D8657 
14D832E03C6D054 
3D32322559B094E20D8935E250B6EC139AC4AAB77920812C119AF419FB62B332 
C8D226C6C9362AE3C1E4AABE19359B8428EA74EC8FBE83C8618C2BCCB6B43FBA 
A0F2CCB7D303945 


With SHA-384, message = "sample": 


k = 


OFEFOB68CB4 945 3A4C 6ECBF1708DBEEFC885C57FDAFB88417AAEFA5B1C35017B 
4B498507937ADCE2F1D9EFFASFE8F5AEB116B804FD182A6CF1518FDB62D53F 60 
AOFF6EB707D856B 
375D8F49C656A0BBD21D3F54CDA287D853C4BB1849983CD8 91EF 6CD6BB56A62B 
687807C16685C2C9BCA2 663C33696ACCE344C45F3910B1DF806204FF731ECB28 
9C100EF4D1805EC 

1CDEC6F46DFEEE44BCE71D41C60550DC67CF98D6C91363625AC2553E4368D2DF 
B734A8E8C72E118A76ACDB0E58697940A0F3DF49E72894BD799450FC9E550CC0 
4B9FF9B0380021C 


With SHA-512, message = "sample": 


k = 


K 
ll 
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3FF373833A06C791D7AD58 6AFA3 990F 6EF76999C35246C4AD0D51 9BFF180CA18 
80E11F2FB38B764854A0AE3BECDDB50F05AC4FCEE542F207C0A6229E2E19652F 
0E647B9C4882193 
1C26F40D940A7EAA0EB1E62991028057D91FEDA0O366B606F6C434C361F04E545 
A6A51A435E26416F6838FFA260C617E798E946B57215284182BE55F29A355E60 
24FE32A47289CF0 
3691DE4369D921FE94EDDA67CB71FBBEC9A436787478063EB1CC778B3DCDC1C4 
162662752D28DEEDF6F32A269C82D1DB80C87CE4D3B662E03AC347806E3F19D1 
8D6D4DE7358DF7E 
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With SHA-1, message = "test": 

k = 019B506FD472675A7140E429AA5510DCDDC21004206EEC1B39B28A688A8FD324 
138F12503A4EFB64F 9348 40DFBA2B4797CFC18B8BD0B31BBFF 3CA6 6A4 33 9E4EF 
9D771B15279D1DC 

r = 133F5414F2A9BC41466D339B79376038A64D045E5B0F792A98E5A7AA87E0ADO1 
6419E5F8D176007D5C9C10B5FD9E2E0AB8331B195797C0358BA0O5ECBF24ACE59 
C5F368A6C0997CC 

s = 3D16743AE9F00F0B1A500F738719C5582550FEB64689DA241665C4CE4F328BA0 
E34A7EF527ED13BFA5889FD2D1D214C11EB17D6BC338E05A56F41CAFF1AF7B8D 
574DB62EF0DOF21 


T 


With SHA-224, message = "test": 

k = 333C711F8C62F205F926593220233B06228285261D34026232F6F729620C6DE1 
2220F282F4206D223226705608688B20B8BA86D8DFE54F07A37EC48F253283AC 
33C3F5102C8CC3E 

r = 3048E76506C5C43D92B2E33F62B33E3111CEEB87F6C7DF7C7C01E3CDA28FA5E8 
BE04B5B23AA03C0C70FEF8F723CBCEBFFO0OB7A52A3F5C8B84B741B4F6157E69A5 
FB0524B48F31828 

s = 2C99078CCFE5C82102B8D006E3703E020C46C87C75163A2CD839C885550BA5CB 
501AC282D29A1C26D26773B60FBEO5AAB62BFAOBA32127563D42F7669C97784C 
8897C22CFB4B8FA 


With SHA-256, message = "test": 

k = 328E02CF07C7B5B6D374 9D8302F1AE5BFAA8F2 3939845 9AF4A2C859C7727A812 
3A7FE9BE8B228413FC8DCOE9DE1 6AF3F8F43005107F998 9A5D97A5C4455DA895 
E81336710A3FB2C 

r = 184BC808506E11A65D628B457FDA60952803C604CC7181B59BD25AEE1411A66D 
12A777F3A0DC99E1190C58D0037807A95E5080FA1B2E5CCAA37B50D401CFFC34 
17C005AEE963469 

s = 27280D45F81B19334DBDB07B7E63FE8F39AC7E9AE14DE1D2A6884D2101850289 
D70EE400F26ACA5E7D73F534A14568478E59D00594981ABE6A1BA18554C13EB5 
E03921E4DC98333 


With SHA-384, message = "test": 

k = 2A77E29EAD9E811A9FDA0284C14CDFA1D9F8FA712DA59D530A06CDE54187E250 
AD1D4FB5788161938B8DE049616399C5A56B0737C9564C9D4D845A4C6A7CDFCB 
FFOFO1A82BE672E 

r = 319EE57912E7BOFAA1FBB145B0505849A89C6DB1ECO6EA20A6A7EDE072A6268A 
F6FD9C809C7E422A5F33C6C3326EAD7402467DF3272A1B2726C1C20975950F0F 
50D8324578F13EC 

s = 2CF3EA27EADD0612DD2F96F46E89AB894B01A10DF985C5FCO99CFFEOEAO83EB4 
4BE682B08BFE405DAD5F37D0A2C59015BA41027E24B99F8F75A70B6B7385BF39 
BBEA02513EB880C 
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With SHA-512, message = "test": 

k = 21CE6EE4A2C72C9F93BDB3B552F4A633B8C20C200F894F008643240184BE57BB 
282A1645E47FBBE131E899B4C61244EFC2486D88CDBD1DD4A65EBDD837019D02 
628DODCD6ED8FB5 

r = 2AA1888EAB05F7B00B6A784C4F7081D2C833D50794D9FEAF6E22B8BE728A2A90 
BFCABDC803162020AA629718295A148 9EE7EDOECB8AAA1 97B9BDFC49D18DDD78 
FC85A48F9715544 

s = 0AA5371FE5CA671D6ED9665849C37F394FED85D51FEF72DA2B5F28EDFB2C6479 
CA63320C19596F5E1101988E2C619E302DD05112F47E8823040CE540CD3E90DC 
F41DBC461744EE9 
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A.3. Sample Code 


We include here a sample implementation of deterministic DSA. It is 
meant for illustration purposes; for instance, this code makes no 
attempt at avoiding side-channel leakage of the private key. It is 
written in the Java programming language. The actual generation of 
the "random" value k is done in the computek() method. The Java 
virtual machine (JVM) is assumed to provide the implementation of the 
hash function and of HMAC. 


// 


import java.math.BigInteger; 

import java.security.InvalidKeyException; 
import java.security.MessageDigest; 

import java.security.NoSuchAlgorithmException; 
import javax.crypto.Mac; 

import javax.crypto.spec.SecretKeySpec; 


+ 


/ 
Deterministic DSA signature generation. This is a sample 
implementation designed to illustrate how deterministic DSA 
chooses the pseudorandom value k when signing a given message. 
This implementation was NOT optimized or hardened against 
side-channel leaks. 


An instance is created with a hash function name, which must be 
supported by the underlying Java virtual machine ("SHA-1" and 
"SHA-256" should work everywhere). The data to sign is input 
through the {@code update()} methods. The private key is set with 
{@link #setPrivateKey}. The signature is obtained by calling 
{@link #sign}; alternatively, {@link #signHash} can be used to 
sign some data that has been externally hashed. The private key 
MUST be set before generating the signature itself, but message 
data can be input before setting the key. 


Instances are NOT thread-safe. However, once a signature has 

been generated, the same instance can be used again for another 
signature; {@link #setPrivateKey} need not be called again if the 
private key has not changed. {@link #reset} can also be called to 
cancel previously input data. Generating a signature with {@link 
#Sign} (not {@link #signHash}) also implicitly causes a 

reset. 


+ + + F + + + FF F F FF FF FF FF FF FF FF FF F F KF KF OF 


+ 


Copyright (c) 2013 IETF Trust and the persons identified as 
authors of the code. All rights reserved. 


+ + 
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+ + XA RR OR F > 


Redistribution and use in source and binary forms, with or without 
modification, is permitted pursuant to, and subject to the license 
terms contained in, the Simplified BSD License set forth in Section 
4.c of the IETF Trust's Legal Provisions Relating to IETF Documents 
(http: //trustee.ietf.org/license-info). 


Technical remarks and questions can be addressed to: 
pornin@bolet.org 


public class DeterministicDSA { 


private String macName; 

private MessageDigest dig; 

private Mac hmac; 

private BigInteger Pp, q; 9, x; 
private int qlen, rlen, rolen, holen; 
private byte[] bx; 


/ 
Create an instance, using the specified hash function. 
The name is used to obtain from the JVM an implementation 
of the hash function and an implementation of HMAC. 


+ RAR F O > 


fparam hashName the hash function name 
* (throws IllegalArgumentException on unsupported name 
ara 
public DeterministicDSA(String hashName) 
{ 
try { 
dig = MessageDigest.getInstance (hashName) ; 
} catch (NoSuchAlgorithmException nsae) { 
throw new IllegalArgumentException (nsae) ; 
} 
if (hashName.indexOf(’-’) < 0) { 
macName = "Hmac" + hashName; 
} else { 
StringBuilder sb = new StringBuilder (); 
sb.append("Hmac") ; 
int n = hashName.length(); 


for (int i = 0; i < n; i ++) { 
char c = hashName.charAt (i); 
it (alt= =") 4 


sb.append (c); 


} 


macName = sb.toString(); 
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} 
try { 
hmac = Mac.getInstance (macName) ; 
} catch (NoSuchAlgorithmException nsae) { 
throw new IllegalArgumentException (nsae) ; 
} 
holen = hmac.getMacLength (); 


/** 

* Set the private key. 

* 

* @param p key parameter: field modulus 
* @param q key parameter: subgroup order 
* @param g key parameter: generator 

* @param x private key 

*/ 


public void setPrivateKey (BigInteger p, BigInteger q, 
BigInteger g, BigInteger x) 
{ 


~ 


Fo + + + + + F * F > 


Perform some basic sanity checks. We do not 
check primality of p or q because that would 
be too expensive. 


We reject keys where q is longer than 999 bits, 
because it would complicate signature encoding. 
Normal DSA keys do not have a q longer than 256 
bits anyway. 


|| g == null || 
| q.signum() <= 0 
g || x.signum() <= 0 
x.compareTo ( = 0 | | q.compareTo(p) > 
q-bitLength() > 999 
g ( 
g 
O 


H- 


1 
p.signum() <= 0 
.signum() <= 0 


0 


-compareTo(p) >= 0 | | g.bitLength() == 1 
.modPow(q, p).bitLength() != 1) ( 


"invalid DSA private key"); 
} 
this. 
this. 
this: 
this.x = 
qlen q.bitLength(); 
if (q.signum() <= 0 || qlen < 8) { 
throw new IllegalArgumentException ( 
"bad group order: " + q); 


Ix Qa 
"on 
QR 
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private 


private 


private 


/** 


Determinis 


} 


rolen = (qlen + 
rlen = rolen * 
/* 


* Convert the private exponent 


* of octets. 
*/ 


bx = int2octets 


BigInteger bits 


BigInteger v = 
int vlen = in.l 
if (vlen > qlen 

v=v.s 
} 


return v; 


byte[] int2octe 

byte[] out = v. 

if (out.length 
byte[] 
System. 


return 
} else if (out. 

bytel[] 

System. 


return 
) else { 
return 


} 


byte[] bits2oct 
BigInteger zl 


BigInteger z2 = 
return int2octe 


Inf 


tic DSA and ECDSA 


7) >>> 3; 
8; 


(x) 
(x); 
2int (byte[] in) 
new BigInteger (1, in); 
ength * 8; 


) { 
hiftRight (vlen - qlen); 


ts (BigInteger v) 


toByteArray (); 

< rolen) { 

out2 = new byte[rolen]; 
arraycopy (out, 0, 

out2, rolen - out.length, 
out.length) ; 

out2; 

length > rolen) { 

out2 = new byte[rolen]; 
arraycopy (out, 
out2, 0, rolen); 
out2; 


out; 


ets (bytel[] in) 


= bits2int (in) 


zl.subtract (q) 
) 


ts(z2.signum() < 0 ? zl 


ormational 


into a sequence 


out.length - rolen, 
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* Set (or reset) the secret key used for HMAC. 
* 
* @param K the new secret key 
*/ 
private void setHmacKey (byte[] K) 
{ 
try { 
hmac.init (new SecretKeySpec(K, macName)); 
) catch (InvalidKeyException ike) { 
throw new IllegalArgumentException(ike); 


+ 


Y 


+ + XA F OR F > 


Compute the pseudorandom k for signature generation, 
using the process specified for deterministic DSA. 


@param h1 the hashed message 
@return the pseudorandom k to use 


™~ 


private BigInteger computek(byte[] h1) 


{ 
/* 


* Convert hash value into an appropriately truncated 
* and/or expanded sequence of octets. The private 


* key was already processed (into field bx[]). 
*/ 
byte[] bh = bits2octets (h1); 


/* 
* HMAC is always used with K as key. 
* Whenever K is updated, we reset the 

current HMAC key. 
Es 


/* step b. */ 

byte[] V = new byte[holen]; 

for (int i = 0; i < holen; i ++) { 
V[i] = 0x01; 

} 


/* step c. */ 
byte[] K = new byte[holen]; 
setHmacKey (K); 


/* step d. */ 
hmac.update (V); 
hmac.update ( (byte) 0x00); 
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hmac .update (bx); 
hmac.update (bh) ; 

K = hmac.doFinal (); 
setHmacKey (K) ; 


/* step e. */ 
hmac .update (V); 
V = hmac.doFinal(); 


/* step f. */ 

hmac .update (V); 
hmac.update ( (byte) 0x01); 
hmac .update (bx); 
hmac.update (bh) ; 

K = hmac.doFinal (); 
setHmacKey (K); 


/* step g. */ 
hmac.update (V); 
V = hmac.doFinal (); 


/* step h. */ 


August 2013 


byte[] T = new byte[rolen]; 

for (75) 1 
/* 
* We want glen bits, but we support only 
* hash functions with an output length 
* multiple of 8;acd hence, we will gather 
* rlen bits, i.e., rolen octets. 
* 


™~ 


int toff = 0; 

while (toff < rolen) { 
hmac.update (V); 
V = hmac.doFinal (); 


int cc = Math.min(V.length, 
T.length - toff); 
System.arraycopy(V, 0, T, 


toff += cc; 
) 


BigInteger k ts2int (T); 


tort, cc); 


= bi 
if (k.signum() > 0 && k.compareTo(q) < 0) { 
k; 


return 


} 
/* 


* k is not in the proper range; 
* K and V, and loop. 
Pi 
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hmac .update (V); 
hmac.update ( (byte) 0x00); 
K = hmac.doFinal (); 
setHmacKey (K); 
hmac.update (V); 

V = hmac.doFinal (); 


} 
/[** 


* Process one more byte of input data (message to sign). 
* 


* @param in the extra input byte 
*l 
public void update (byte in) 
{ 
dig.update (in); 
} 


[** 


* Process some extra bytes of input data (message to sign). 
* 


* @param in the extra input bytes 
*/ 
public void update (bytel[] in) 
{ 
dig.update (in, 0, in.length); 
) 


[** 

* Process some extra bytes of input data (message to sign). 
* 

* @param in the extra input buffer 

* @param off the extra input offset 

* @param len the extra input length (in bytes) 

*/ 


public void update(byte[] in, int off, int len) 
{ 

dig.update (in, off, len); 
} 


/ 
Produce the signature. {@link #setPrivateKey} MUST have 
been called. The signature is computed over the data 
that was input through the {@code update*()} methods. 
This engine is then reset (made ready for a new 
signature generation). 


+ + + + ORO > 
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* @return the signature 
*/ 
public byte[] sign() 
{ 
return signHash (dig.digest ()); 
} 


+ 


/ 
Produce the signature. {@link #setPrivateKey} MUST 

have been called. The signature is computed over the 
provided hash value (data is assumed to have been hashed 
externally). The data that was input through the 

{@code update*()} methods is ignored, but kept. 


If the hash output is longer than the subgroup order 

(the length of q, in bits, denoted 'qlen'), then the 
provided value {@code hl} can be truncated, provided that 
at least qlen leading bits are preserved. In other words, 
bit values in {@code h1} beyond the first qlen bits are 
ignored. 


@param hl the hash value 
@return the signature 


+ + + + + + FF F F F F AC AC F KF OF 


y 


public byte[] signHash(byte[] h1) 
{ 
if (p == null) { 
throw new IllegalStateException ( 
"no private key set"); 


try { 

BigInteger k = computek (h1); 

BigInteger r = g.modPow(k, p) .mod(q); 

BigInteger s = k.modInverse (q) .multiply ( 
bits2int (h1) .add (x.multiply(r))) 


.mod (q); 
/* 
* Signature encoding: ASN.1 SEQUENCE of 
* two INTEGERs. The conditions on q 
* imply that the encoded version of r and 
* s is no longer than 127 bytes for each, 
* including DER tag and length. 
* 


/ 

byte[] br = r.toByteArray(); 

byte[] bs = s.toByteArray(); 

int ulen = br.length + bs.length + 4; 
int slen = ulen + (ulen >= 128 ? 3 : 2); 
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byte[] sig = new byte[slen]; 
int i = 0; 
sig[i ++] = 0x30; 
if (ulen >= 128) { 
sig[i ++] (byte) 0x81; 
sig[i ++] = (byte)ulen; 
} else { 
sig[i ++] = (byte)ulen; 
} 
sig[i ++] = 0x02; 
sig[i ++] = (byte)br.length; 


System.arraycopy (br, 
i += br.length; 
sig[i ++] = 0x02; 


0, sig, i, br.length); 


sig[i ++] = (byte)bs. 
System.arraycopy (bs, 
return sig; 


} catch (ArithmeticException 


length; 


0, sig, i, bs.length); 


ae) { 


throw new IllegalArgumentException ( 


"DSA error 


/** 
* Reset this engine. 
* update*()} methods is discarded. 
* if one was set, is kept unchanged. 
*/ 
public void reset () 
{ 
dig.reset (); 
} 


(bad key ?)", 


ae); 


Data input through the {@code 


The current private key, 


// 
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